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A. INTRCDUCTION 


Susceptibility refers to the inability of a target to 
avoid being damaged in the pursuit of its mission. Lox 
aircraft, susceptibility to an externally detonating warhead 
refers to an aircraft's probability of being hate 
Suscertitility, like vulnerability, is good. The level or 
degree of susceptibility of an aircraft in an encounter with 
a threat is dependent upon three major factors, the 
encounter scenario, the threat, and the aircraft. The 
encounter scenario includes the missile and aircraft fosi- 
tions, velocity vectors, respective attitudes, a determina- 
tion of the warhead's fragment dynamic spray angles, a 
determination of the missile miss distance, and the determi- 
Mation of how many fragments or penetrators strike the 
aeerart. The important features of the threat are its 
Characteristics, its operations, and its lethality. The 
important aircraft features are the aircraft detectable 
Signatures, countermeasures, performance capabilities, and 


self-protection armamrent. 


Be. ENCOUNTER SCENARIC 


The encounter scenario takes into account the missile's 
flight path and the target's flight path to allow calcula- 
tion of the missile bmiss distarce, fragment miss distance, 
the warhead's dynamic fragment spray angles and velocities, 


and the number of fragments which strike the target. 


11 


1. Warhead Dynamic Spray Angles and Velocities 


When a warhead detonates in the vicinity of an 
aircraft, the fragments or peretrators are usually ejected 
uniformly around the missile axis and propagate outward in a 
divergent spherical-like spray pattern at a velocity that is 
the vector sum of the initial fragment ejection velccity 
from a static warhead detonaticn and the missile velocity. 
The fragment at the front of the warhead is assumed to 
propagate outward at the leading spray angle, and the frag- 
ment at the tail end of the warhead is assumed to propagate 
along trajectory at the trailing spray angle. All other 
fragment trajectories lie between these two spray angles and 
constitute the fragment spray. As the aircraft moves in 
Space, the fragments propagate outward and eventually some 
of the fragments may strike the aircraft. Whether or not 
any of the fragments strike the aircraft and where they hit 
depend upon the relative positions, velocities, and the 
attitude of the warhead and the aircraft at the time of 
detonation (encounter conditions) andthe fragment static 
velocities and static spray angles. A sample warnead 
depicting static fragment spray angles and velocities, and 
dynamic fragment spray angles and velocities is depicted in 
Figure 1.1. Using the law of cosines and Figure 1.1, the 


dynamic fragment velocity, V.: 


,¢ is given by: 


Vi2=Vi2+ V2 - (2x4, x ¥ 


, x CosB) (1.1) 


where Le is the missile velocity and ye is the static frage 
ment velocity. Since the angle 8 is not known, Equation 1.1 
must be rearranged to use the only known angle, which is the 
static fragment spray angle, a. Rearranging Equation 1.1, 


the dynamic fragment velocity is given by: 
Veeco 2 + 2- —(. 
‘e Ve ft 2s a x Vo x Cos(180-a,) ] (1.2) 
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Again referring to Figure 1.1, the dynamee fragment) velccim, 
may ke written in vector notaticn as: 
Ve (ar egies Ccesa,) Ji + [Vs x Sind, Jj (ean) 


Solvirg Eguation 1.3 for the dynamic fragment spray angle, 


> «» yields: 
dé; = Tanu1( (Ve8e "S107 tt ee ore) (1.4) 


Now that the dynamic fragment spray angles and velocities 


are known, the fragment spray density may be determined. 
2. Fragment Spray Density 


The damage inflicted or an aircraft depends on the 
number and the locaticn of the fragment impacts, and on the 
terminal effects parameters such as the fragment mass and 
impact velocity. For this derivation of the fragment spray 
density, the following assumpticns are made: 

1. The fragments lie on a Spherical segment whose center 
is at the center of the warhead. 
2. The fragments emerge from the warhead in such a way 
that they remain on the surface of an expanding sphere. 
An encounter scenaric with a hcrizontally moving aircraft, 
and based on the assumptions stated above, is depicted in 
Figure 1.2: 

For any given fragment spray zone, the density of 
fragments within that zone is simply the number of fragments 
contained in the zone divided by the surface area of the 
Sphere contained within the conical angles defining the 
zone. The average rumber of fragments per unit area of 
fragment spray, known as the fragment spray density , 9, is 
given by Equation 1.5. 
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Figure 1.2 Sample Encounter with a poe Moving 
Aircraft Depicting the Fragment Spray Density 
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yA (1.5) 


z®, 
it 
= 


where N is the total number of fragments in the warhead and 
Ais the area the fragments are spread over. Referring to 


Figure 1.2, the area, A, is given by: 


o 
2 

RS 22 Xe x f (s x Sin?) x s dé (1.6) 
oy 


Solving Equation 1.6 leads to the solution; 
A=2x 7 x s2? x (Cos % - Ces $, ) (1.7) 


Substituting Equation 1.7 into Equation 1.5 yields the) frag 
Tent spray density at some distance s from the detonation 


bourne: 
0 =Nvz7[2x 7 x s2 x (Cos $, - Cos % )] (Ve38p 


where the leading and trailing dynamic fragment spray angles 
are defined, with respect to the warhead axis, by Equation 
Veith 


3. Missile Miss Listance 





For the calculation of missile miss distance, itis 


assumed that the encounter is two dimensional, and that the 


target's velocity and the missile's velocity remain 
constant. Two approaches to calculate the miss distance 
will ke presented. The first approach is the glotal 


approach. 
a. Global AEEEoach 


Figure 1.3 depicts a typical encounter situation. Figure 
1.4 depicts the same encounter situation using vectcr nota- 
ELon. Referring to Figure 1.4, and using vector addition, 


the missile miss distance, s, ig given by Equation 1.9. 
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[mst =M+n+ s (1.9) 


Rearranging Equation 1.9 and solving for s leads to: 


S = (T- M) + (£ - py aac) 
The initial conditions (at time t = 0) are given by 
Bametions 1.11 and 1.12. The conditions at some later time 


(t = T) are given by Equations 1.13 and 1.14. 


fe= (T)2 + (TF aa 

M= (M)a + (MG ee 
= (WT + (495 (1. 12) 

~ w~ 

t = (Vv. x 7) 1. (Tea t3,) 

T= (vx tx cose )i + (V xt x Sine)F (1. 14) 


Substituting these conditions back into Equation 1.10 gives: 


S= Ch - ai + L- wg) + CO, x 7) co 


= (V_ x i x Cos6))a - CVs. SxXeer x Sin 6)5] 
m 


Rearranging Equation 1.15 and combining similar components 


gives: 


Seams - MN) + «Ox (Y, - (Vx Cos @)) jj Fieaian 


x 


*+[(T -m)- (V x 7 x Sing) 1G 
y Y m 


The missile miss distance is given by taking the magnitude 
oe EGUation 1.16 which is: 


ett Beitr -  xcosed) i? a, 


fe eC ee he) - (Vx t x Sing) j2 
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Of interest is the minimum miss distance. Taking the deriv- 
ative of Equation 1.17 with respect to T, and setting it 


equal to zero yields: 


Cc - M3 a ae = {V x Cos 6)}) = oe (Tsay 
x (VO x Sin 8)03 ) + ieee cn - ou x Cos 6)} 
+ (VX (Sine) = jij 


Solving Equation 1.18 for t yields t for the minimum niss 


distance which is: 


= C((T, = A.) x ue x Sin 9) + ((T = Me) . (1.19) 
x v x Cos 6)3-— ((T = aM) x eee / 
Ce (Vv, x Cos 6))2 + vee ek Sin 9)2] 


The minimum missile miss distarce is then given by substi- 
tuting the value of T , obtained from Equation 1.19, into 


FoulabiaoOne le? . 
b. Local Approach 


The local approach is an alternative approach to the one 
described above. ‘In the local approach, the target remains 
Stationary and the target's velocity vector is superimposed 
on the missile's velocity vector. This geometry is depicted 
in Figure 1.5. From Figure 1.5, the velocity of the missile 
with the target's velocity superimposed, yee , becomes: 


re ‘~~ : es ”~ 
ge Oe xX COS 0 jars a x S209) je ae (1. 205 
Rearranging Equation 1.20 into a more suitable form gives: 


~ “ A 
Vie = U4, © COSeC ery (1.21) 
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The derivation of tke minimum nissile miss distance in the 
local system follows the same procedure as for the glotal 
System, and since it leads to the same result as given by 
Eguation 1.17, the derivation will not be repeated. 

From the geometry of Figure 1.5, it is fossible 
to determine if the missile will bea "late bird" or an 
"early bird". An "early bird" is where the closest foint of 
approach (CPA) of tke missile is in front of the target in 
the local systen. A "late bird" is where the CPA of the 
missile is behind the target. This relationship may be 
determined graphically with the use of the follcwing 


formula: 
@ = Tan-1 [(¥, * Sind) / 1(%, x Cosd) = % J] (122 


Now that the missile miss distance has been 
calculated, and knowing the fragment spray density, a deter- 
Mination must be made as to whether or not the fragments hit 
the target, and if so, how many fragments strike the target. 
To acccmplish this, the fragment miss distance must be 


determined. 
4. Fragment 


As was the case for maieene Miss distance, the frag- 
ment miss distance may be derived in either a global ccordi- 
nate system or ina local coordinate systen. Figure 1.6 
depicts the fragment miss distarce for the global coordinate 
system, and Figure 1.7 depicts the miss distance for the 
global system using vector notation. Figure 1.8 depicts the 
fragment miss distance in the lccal coordinate system. The 
derivaticn of the fragment miss distance in a glokal cccrdi- 
nate system follows. Referrirg to Figure 1.7, and using 
vector addition, the fragment miss distance, c, is given by 


Rouaeti10n 14,23. 
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C= (T- FP + &- feos} 


The initial conditions are given by Equations 12,24 and) 1228 
The ccnditions at scre later time (t = T) are given by 
EGuations lo 26,and sie 27c 


—_ w*~ o&™~ 
TS 3 a (1.24) 
y 

- a > 

oo (2) ee (1.25) 
te We x t)a (1. 26) 
= ~ : “~ 

£= (VV; x Tt X CosSy¥)4-* (eee eee (1.250) 


Substituting these conditions kack into Equation 1.23, and 


solving for c, leads to: 


€=[( (i - Fy) - (tT x ((Y, x Cosy) - ¥))78 (tegen 
[(ly - Fy) - (1 x x Siny) ]j 


The magnitude of Equation 1.28 is: 


icf = [ (7, = F,) - £7 © CY) 25 Cos me Ve eee 

+ CCT ~F,) = (> Xx Voex Sei 
To find the minimur fragment miss distance, i: for the 
minimum miss distance is needed. Taking the derivative cf 


Equation 1.29 with respect tot , and setting it equal to 


zero yields: 
c= (A(R, = Bey eos" )) aa mee (1.30) 


{ (1, - F) x V, x Sin wea 7 Cosme ee 
+ ke xX Sins y= 3 


Ze 





To find the minimum fragment suiss distance, Simply solve 
Equation 1.30 for t, and substitute that value of T into 
Boata1on 1.29. This derivaticn assumed that the fragment 
velocity was constant. If tke fragment velocity is not 


@eometant, Of reasonaltly so, then f is given by: 
= a 
if ay [ (Vv, me COS >) ae (Vv. X Sip y.) jj] & (1.31) 


Semvying Equation 1.31 gives: 


c 
f = micosy)1 + (Siny}9] x tigi alae (leans 2 } 


~ 


Now tkat the fragment miss distance has been calculated, the 
number of fragments which strike the target will be 


determined. 


5S. Fragment Impacts on the Target 


The number of hits, mn, on the aircraft presented 


area at the aspect under consideration, A 1s given by: 


pe’ 


h = ?/ x A, (1...33) 


where 9 is the fragment spray density defined by Equation 
1.8. Figure 1.9 depicts the fragment spray density striking 
eieeaircraft in the local coordinate system descrited 
earlier, where £,; and f5 represent the leading edge and 
trailing edge fragment vectors, respectively. The angle ¥ 
is defined as: 


>y = Tan-? ([(¥. x Siny ) / ((¥, x Cosy ) - V¥)] (1.34) 
1 i 2 4 t 


Figure 1.10 depicts the same geometry in the global cocrdi- 
Mate system described earlier. Recaliereon Equation 1.8 


that the distance tte fragments travel before striking the 
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aircraft, 8, is needed and not bee The time from detona- 


tion to fragment impact in the clobal system is: 
t = Rk / V. (1225) 


The time from detonation to fragment impact in the local 


system is: 
t = R det Ws Vet (1.36) 
where V,, is defined as follows: 


= _- 1 2 2 
ieee aie x Cosy ) ue j}2 + en x Sina] (16.270 


Equating Equation 1.35 to Equation 1.36, and solving fore: 


yields: 


det 
2 
+ OW 7 


R@ = R e7 (1- 42% @ Jl.) xeeos (1. 3a 
te 2 


where cm is the target velocity and v. is the dynamic frags 
ment velocity as defined by Equation 1.2. The extent of the 


fragment spray which strikes the aircraft, and the numker 


and locaticn of fragment hits, are dependent ufon the 
encounter conditions. Figure 1.11 depicts the effects of 
varying the detonaticr distance to the target. In zone 1, 


the full fragment spray hits the target. In Zone 2, all og 
the target is hit by fart of the fragment spray. In zones 3 
and 4, part of the fragment sfyray hits part of the target. 
In zone 1, with the target hit by the full fragment sfray, 
the presented area cf the aircraft may be determined as 
follcews. Figure 1.12 depicts a frontal view of the fragment 
spray striking an aircraft. From Figure 1.12, the angle ¢@ 


is defined by Equaticr 1.39. 
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Figure 1.12 Frontal View of Fragments 
Impacting an Aircraft 
c = Tan-! [W / (2 x R x Sing )] (1235) 
The circumferential length of tke spray zone is defined as: 
b=2x tx R x Sind (1.40) 
where » 1s the dynamic fragment spray angle of the center 
fragment. Substituting Equation 1.39 into Equaticn » loa2 


yields: 


b=2 X% RX SIN dX Vanate tw Pelzer een (1.41) 


Sz 





The fragnent spray zcne covers a spherical area of; 

meea = b x Rx (%5 =, ) edie 
Mimeaireucing Equation 1.42 into Equation 1.33 yields: 

n= (Nx b) [2x 7 x R x (Cos, - Cos $2) ] (led 3) 


which determines the number of fragments which strike the 
aircraft in zone 1. The assumption has been made in this 
estimaticn that the fragment Spray covers the entire 
presented area of the aircraft. If this is not the case, or 
if only a portion of the spray meridian hits a _ fortion of 
E@emaitcraft (zones 2, 3, and 4 in Figure 1.11), Ase in 
Ecuation 1.33 must be reduced to the actual area that is 
struck ry fragments. The extent of the fragment spray which 
does strike the aircraft, the number of fragment hits, the 
fragment approach directions, and where the hits cccur are 
dependent upon the encounter ccnditions. For example, a 
detonation directly trelow the center of the aircraft ina 
head-cn encounter will have a different result than froma 
detonation in the same place fcr a tail-chasing missile due 
to the difference in the relative closing velocity. 
Furthermore, changing the elevation angle of the missile at 
the time of detonaticn will change the results. With the 
number of fragments which strike the aircraft determined, 
the effects of fragments and penetrators striking an 


aircraft will be examined in the next chapter. 
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If. TARGET VUINERABILITY 


A. INTRODUCTION 


Target vulnerability refers to the inability of a target 
to withstand one or tore hits by damage mechanisms (frag- 
ments, penetrators, incendiary particles, and blast) or a 
target's liability to serious damage or destruction when hit 
ty enemy fire. Aircraft that are more vulneratle are 
softer, that is, they are more likely to be lost when hit. 
Therefcre, aircraft vulnerability is essentially a measure 
of the toughness of an aircraft when all surviveability 
measures have failed and the threat interacts with the 
aLECEAEC. From an air defense standpoint target vulner- 
ability is good. 

Each individual ccmponent cf an aircraft has a certain 
level or amount of vulnerability. Each component's vulner- 
ability then contributes, in scme measure, to the overall 
vulnerability of the aircraft. The critical components of 
an aircraft are those components that are essential tc the 
functicning of a system, and if the component performance is 
sufficiently degraded or if the component is rendered inop- 
erative by combat damage, a target kill in some kill 
category will result. The systematic description, delin- 
eaticn, and quantification of the vulnerability of the indi- 
vidual ccmronents and vulnerability of the total aircraft is 


known as a vulnerability assessment. 


BEB. IDENTIFICATION OF CRITICAL COMPONENTS 


The first step ina vulnerability assessment is the 
identification of those comporents whose damage or loss 


could lead to an aircraft kill, and they are referred to as 
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critical components. thismireertLliicatron=process is calied 
critical component analysis. A component may be a critical 
component because it provides an essential function such as 
mest, lift, or control. A component may also be a crit- 
ical ccmponent because its mode of failure leads to the 
failure of a critical component that does provide an essen- 
ieee cunction. For example, a fuel tank in a wing can be 
perforated by a fraguent, causSirg a slow fuel leak and even- 
tual fuel depletion, with no substantial effect on the 
continued operation cf the aircraft. In this situation, the 
wing fuel tank is not a critical component. On the other 
hand, the fragment impact and penetration of the wing tank 
could cause ignition cf the fuel vapor in the ullage, with a 
subsequent fire or explosion anc loss of the aircraft. a 
this case, the wing tank is definitely a critical component. 

A general procedure has been developed for determining 
the critical components, their possible damage or failure 
modes, andthe effects of the component damage or failure 
upon the continued oferation cf the aircraft. ihis se Loce. 
dure consists of: (1) a selection of the aircraft kill 
levels or categories to be considered, (2) an assembly of 
the technical and functional description of the aircraft, 
and (3) the determination of the critical components of the 
aircraft and their damage-caused failure modes for the 
selected kill levels. 


1. Aircraft Kili Levels 





To assess the vulnerability of both fixed wing and 
rotary aircraft in-flight, fovrr kill categories have been 
defined. These kill categories are the Attrition Kill, the 
Mission (Mission Abort) Kill, the Forced Landing Kill, and 
the Missicn Available Kill. 
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a. Attrition 


Attrition kill Covers those aircraft with ccmtaw 
damage so extensive that it is neither reasonable nor 
econcmical to repair. The attrition category is divided 
into the six levels cf kill listed below. 

(1) ORK eka This level of kill is associated 
With damage that will cause tke aircraft to disintegrate 
immediately upon being hit. This kill level is also 
referred to as a Catastrophic Kill. 

(2) “Kokua: This level of kill is associated 
with damage that will cause an aircraft to fall out of 
manned ccntrol within 30 seconds after being hit. 

(Cp eee ee ol This level of kill is associated 
with damage that will cause an aircraft to fall out of 
Manned ccntrol within five minutes after being hit. 

(ee 5 koe This level of kill is associated 
with damage that will cause an aircraft to fall out of 
Manned control within 30 minutes after being hit. 

(5) (Cen: This level of kill is associated 
with damage that will cause an aircraft to fall out of 
manned ccntrol before completeing its mission. 

(oy = Kae This level of kill is associated 
with damage that will cause an aircraft to sustain addi- 
tional levels of damage upon MJlanding and makes it uneccncn- 
ical to repair as sfecified [y the applicable Technical 


Orders, Technical Bulletins, anc regulations. 
bk. Mission (Mission Akcrt) Kill 


This category covers any aircraft with comkat 
damage that prevents the aircraft from completing its 
mission. This 1S mission dependent and is divided into two 
levels; misSion abcrt and mission kill. Mission abcrt 


covers aircraft which are net lost to inventory but cannot 
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complete their missicn. Massienekidl covers aircraft which 


fall cut of manned ccntrol before completing their mission. 
Co eeroreed Landing Kiil 


This category covers those aircraft with ccnkat 
damage that forces the crew to execute a controlled landing 
(powered or unpowered). This category includes aircraft 
with damage which will require repairs for flight tc ancther 
area and aircraft with damage which cannot be repaired on 
site but which can ke recovered by a special team. This 
categcry has been restricted mainly to rotary wing aircraft 
which can land nearly anywhere either powered or by autoro- 
tae 1 On. It is more difficult for a damaged fixed wing 
aircraft to successfully execute a forced landing (and/or 
subsecuent takeoff) since some prepared landing site is 


generally reguired. 
d. MisSion Available Kill 


This category covers those aircraft that have 
landed with combat damage and will require repair before 
returning to mission ready status. There are different 
levels (intervals) for missicn availability. The interval 
of time required to accomplish repairs is expressed in 


elapsed time, total man-hours, cr combinations thereof. 


fee Alrcratt Description 


—— a ew eee ee = SS ee ee 


At the beginning of any vulnerability study, as much 
aS pessible of the aircraft's technical and functional 
description must be gathered on each of the major systems of 
Haeewaircraft. The aircraft's technical descriptior ccnsists 
of engineering data which docuaents the physical and func- 
tional relationships of the aircraft's subsystems. The 
types of physical descriptions utilized are general aircraft 


arrangement drawings such as three view and inkoard 
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profiles, installaticn drawings, and schematic diagrams for 
the primary subsystems to inciude: airframe structure, 
propulsicn system, fuel systen, flight contrel systenr 
phneumo-hydraulic system, aircrew, avionics systelL, and 
weapon and delivery systems. The suitability and quantiauy, 
of data available to produce the necessary aircraft 
descriptions are functions of the status of the systen 
withir the acquisiticn or deployment phase. Aircraft tech- 
hical descriptions should utilize all of the data base to 
include: engineering scaled drawings, subsystem functional 
descriptions, technical orders and manuals, and access to 


design personnel. 


3. Critical Comrenent Analysis 


A critical ccuponent is any component that is essen- 
tial to the functioning of a system, and if the component 
performance is sufficiently degraded or if the compcnent is 
rendered inoperative Ly combat camage, a target kill in some 
kill category will result. Fer example, the engine ina 
Single engine aircraft is a critical component for an A kill 
bkecause its loss would lead to an aircraft loss within five 
minutes. 

When two or mere aircraft components are redundant, 
such as two engines, the loss of any one of the redundant 
components will not result in the loss of an essential func- 
tion and hence, that component is not a critical component 
according to the definition given above. This assumes that 
the damage process and loss of one redundant component will 
not lead to the loss cf any other redundant components. For 
example, if one engine of a twin engine aircraft starts to 
Eurn, the assumption is made that the fire will not spread 
to the other engine and destroy it. If this were to happen, 
there is no actual redundancy ard both engines are nonredun- 


dant critical components. Since more than one hit can be 
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expected ina typical threat encounter, it is vossikle that 
all of the redundant components could be killed, leading to 
ameaircraftt kill. Therefore, the fact that a component is 
reduncant does not eliminate it aS a critical component. 
This reguires that a distincticn between the two kinds of 
critical components ke made. In the past, nonredundant and 
redundant critical components have been referred tc as 
Singly vulnerable comfonents and multiply vulnerable ccmfo- 
nents, respectively. This terminology is confusing and will 
not be used here. A given ccmponent may be nonredundant 
with respect to a given kill category and redundant with 
respect tc another kill category. For example, consider a 
twin engine helicopter. If the loss of either engine causes 
a mission abort, the engines are nonredundant for the 
missicn abort category. If the loss of both engines is 
required to cause a crash or ferced landing, the engines are 
redundant for these two kill categories. 

The first step in a critical component analysis is 
to identify the flight and mission essential functicns that 
the aircraft must fyperform ir order to accomplish its 
missicn. The second step is the identification of the major 
systems and subsystems that perform these essential func- 
Eons. The third step is te conduct a Failure Mcde and 
Effects Analysis (FMEA) to identify the relationships 
ketween each possible type cf individual component ofr 
subsystem failure mode and the performance of the essential 
functions. The Fault Tree Analysis (FTA) is sometimes used 
EommmOLrovide additional insight into the identificaticn of 
critical components. The fourth step is to conduct a Damage 
Modes and Effects Analysis (DMEA). The DMEA relates comfo- 
nent or subsystem failure modes to combat-caused damage. 
The combination of tke third and fourth steps is referred to 
as the Failure Mode, Effects, and Criticality Analysis 


(ome CA). The last step in a critical component analysis is 


a 


a visual presentaticn of the list of critical components 
and/or a logical expression to identify the redundant and 
nonredundant critical componerts for the selected kill 
level. The visual fresentaticn is referred to as a kill 
tree and the logical expressicn is referred tc as a kill 


expressicn. 
as Flight and Mission Essential Functions 


Flight essential furctions are those system and 
subsystem functions required to enable an aircraft to 
sustain controlled flight. Mission essential functions are 
those system and subsystem functions required to enable an 
aircraft to perform its designated mission. The analysis 
should consider each phase cf the mission. A typrear 
missicn for an attack aircraft would include such phases as 
takeoff, climb to cruise altitude, cruise to attack area, 
descent tc attack altitude, target location, ordnance 
delivery, egress from the target area, climb to cruise alti- 
tude, return cruise, descent, and landing. The flight and 
mission essential functions should be identified and the 
priority for possible protection established for each of 
these phases. For example, the operation of the electronic 
weapors computer during takeoff is not a flight essential 
function, but it iS a misSicr essential function during 
ordnance delivery. A particular level of operation should 
be identified for the flight essential functions such as 
lnft, thrust, andsceonurol. For example, loss of one engine 
of a twin engine helicopter may not cause a total loss of 
lift and thrust, but it will lead to a reduction of perform 
ance capakilities. This loss of performance may not be 
acceptable in a hostile environment because the heliccpter 
would become an easy target. Therefore, the continued cper- 
ation of both engines may be required to prevent an attri- 


Gaon kale. Special functions must also be identified. 
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These include special functions such as those required for 
the vertical flight cf a VTOL aircraft or those reguired for 
arrested landing aboard an aircraft carrier. A chart iden- 
tifyirg some flight and mission essential functions and scme 
of the mission fhases for an attack helicopter 1s given in 


Prague 2.71. 
rk. System-Essential Furctions Relationshirfrs 


PicmdDieieveOnr dneaddrcratt to £ly and to conduct 
its mission depends upon the continued operaticn of those 
systems and subsystems that perform the essential functions. 
If the aircraft is damaged ir combat, the operaticn of 
Certain sculsystem components may be impaired or the comfo- 
nent may cease to operate, and some essential functicns ray 
pam ost. The severity and rafidity with which the Ilcss of 
essential functions cccur is directly related to the kill 
levels. 

A general examinaticn of each aircraft's systems 
and subsystems must ke conducted to determine its specific 
contributicn to the essential functions identified in the 
previous step. Figure 2.2 presents a sample tabulaticn of 
those systems and suksystems that contribute to the essen- 
tial functions shown in Figure z.1. A more detailed example 
of the relationship Eetween the functions performed by cne 
specific subsystem and the essential functions is shcwn in 


mgr e 2.3. 
Cc. Failure Mode and Effects Analysis (FMEA) 


The Failure Mode and Effects Analysis is a 
procedtre that: (1) identifies and documents all fossitle 
failure modes of a ccmponent or subsystem, and (2) deter- 
mines the effects of each failure mode upon the carability 
of the system and/or subsystexr to perform its’ essential 
functions. The FMEA frocess and requirements are defined in 
mee otp-785 and MIL-SID-1629A. 
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| ESSENTIAL FUNCTIONS 




































Generate electrical 


< | 
Oo 
= | | | i | m 
a | ot. | # | | = 2 
e < w D O — 
5 ~ 3 e | + wy |S ~ 
‘tn om - wy wt = J ~ (‘= 
— 0 a -_ > - ce hun aw 

a — vw qs SS wr wi SS wy aq ee ~~; 
ao | ee “PSEA; Slo 2 2) Sale) ae 2 
aa SUBSYSTEMS setooule |” [6 [mo Hla=aol m | 6 oo | he 
es) -—_— ee =] ~~ _ -— -_ ~~ A fe ° mn -_ & Oo Oo 
n— | > >a aml & -+ | = >psujocer vo} — | = aN —-ca 
2 2) 32] (=) = = 4a = So =~ —- wm wv oo > 1) as 
30 | FUNCTLONS \e=lilesce-][ ¢ | = | 5 [ex cl[au-| = | sa oa =o 

| | 

| 


| 
| 
b | Provide automatic | | | l | | | : 
| concrol and pro- | | | 
| cection of power | | | | 
| generation sil | 


| 
| 
| 
| 
| 
| 
| 


| 
| 
| power | 
| 
| 
| 





c |; Discrirouce elect- | | | | | 
| rical sower | | | | | | | | | 

d , Provide automatic | | | | | { | | | | 
| protection of power| | | | | | | | | | | 
| discribucion | | | | | | | | | | | 

| 

| 

| 





e | Provide power 
conversion (de and 


yo : 
low~-volctage ac) | | 
t j{ Provide battery | | | | | 
| vover | | | 
| | 
| | 


| 

g Control subsystem | | 
| 
| 


| 
| 
| | 
| | | 
| | | 
loads | | | 
i oh | Process and crans- | l | 
| | | 
| | 
| 
| | 


| 
| 
| 
| mic subsyscem data | | | | | 
| 


| 

| | 

| | | 

| | 

| | | 

b | | 

and power control | | | | | | 
siznals | | 

1 | Provide automatic | | | 

| | | 

| | 

| | 

| | 

| | 




















| 
electrical load | | | | 
managemenc 

| 


j | Provide concrols | 
} | and disolavs | | | | | 
1 ok | frovide tilumina- | | | | 
| 


elon | 


Figure 2.3 Subsystem Punctions- 
Essential Functior Relationships 


The types of comperent failure modes generally 
considered in the FMEA include fremature operation, failure 
to operate, failure during operation, failure to cease cper- 


atone and degraded or out-cf-tolerance operation. A 
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determination of the major structural or aerodynamic damage 
tolerances is also performed during the FMEA. ineadaLttion, 
the effects of loss cr major damage to aerodynamic surfaces 
Sumestability and control of the aircraft are required. Data 
generated should define the threshold for aerodynamic, 
structural, and control limits that can be tolerated for 
various flight conditions. A sample summary format for a 
FMEA for two flight centrol roc failure modes is’ given in 
Prawre 2.4. Note in Figure 2.4 that the control rodisa 
Semettcal component for an attrition kill when it jars, tut 
not when is is severed. 

The FMEA is applicatkle to both single ccmpenent 
failures and multiple component failures. Tt is extremely 
important to consider multiple component failures, when the 
failure is due to comkat damage, because of the likelihood 
that more than one ccmponent is damaged when the aircraft 1s 
Pat 

The effects of a ccmponent failure should also 
include the consideration of any transients that might cccur 
when the failure occurs. For example, consider a single 
engine, flv-by-wire, statically unsTable aircraft with no 
mechanical flight controls as kack-up. Suppose the engine- 
driven generator that supplies the electrical power to the 
flight ccntrol computer was to immediately cease operation 
and that the computer relies on an emergency ram-air turbine 
(RAT) for tack up electrical fovwer. The RAT is designed to 
ke defloyed into the airstream when the electrical [ower 
failure is sensed. However, this deployment takes tine, 
during which the computer could be without sufficient pcwer. 
This lack of power could cause froblems with the fly-by-wire 
contrcl system such as the loss of the SAS or the issuance 
of hardover commands to the centrol surfaces which could 
cause the aircraft tc become urcontrollable, leading to an 
abcetatt loss, Thus, the assumption of redundancy in the 


electrical power system is errcreous. 
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d. Damage Mode and Effects Analysis (DMEA) 


In the FMEA the cause of the component failure 
is not stipulated. The failure may or may not be related to 
combat damage. When specific component failures due to 
combat damage, such as mechanical damage to components 
caused ty projectile or fragment penetration or damage 
caused by a fire or explosion, are identified and examined, 
the analysis 1s referred to as a DMEA. mn the DMEA, » the 
potential component or subsystem failures identified in the 
FMEA, as well as other possible damage-caused failures, are 
associated with the damage mechanisms and the damage 
processes. These failures are then evaluated to determine 
their relationship tc the selected kill level. The guanti- 
fication of the compcnent kill criteria is also part cf the 
DMEA, but this procedure is described in the vulnerability 
assessment presentaticn. The possibility of any secondary 
hazard that may be caused by the primary damage processes is 
also identified in the DMEA. Examples of secondary hazards 
are: ingestion of fuel by an engine, and seepage cf toxic 
fumes frcem a fare intc the cockyit. The DMEA is referred to 
as the criticality analysis of the FMECA. 

The output of the LTYEA can take many forms. The 
CMEA matrix iS Similar to the FMEA summary format shcwn in 
Figure 2.4 in which the components and their damage-caused 
failure modes are related to the kill level or category. 
Component redundancy relationships and the appropriate 
component kill criteria should also be indicated in the 
matrix. A sample CMEA matrix iS given in Figure 2.5. A 
disablement diagram can add to the understanding of the DMEA 
matrix by graphically showing the locations of the ccmfo- 
nents and stating the effects cf component kills. A samfle 


disatlement diagram is presented in Figure 2.6. 
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There are many different kinds of damage-caused 
failures or kill modes that can occur within each of the 
systems cf an aircraft. Failure modes for an aircraft are 
the varicus ways in which the aircraft can fail to te main- 
tained in the required mode of flight or fail to perform its 
Missicn. These failure modes are constituted by the less 
of, or serious degradation of, structural integrity, power, 
flight ccntrol or mission reguired equipment, or lift. 
Failure mcdes are established for a given aircraft and 
missicn with respect to preestablished minimum reguirements 
for perfcrmance of tke aircraft and are related to the crit- 
ical ccmfonents of the aircraft. Some of the most lrpertant 
ones are listed in Takle 1 and described below. The crder 
of the systems listed is indicative of their ccntributicn to 
the total aircraft vulnerability. 

(1) Fuel System Kill Modes. The follcwing is 
a listing and brief description of the potential fuel systen 
kill modes. 

Fuel Supply Depletion. This kill mcde is 
caused either by damage to fvel storage components that 
results in excessive leakage leading to a significant reduc- 
tion in the amount of fuel available for aircraft operaticn, 
or by damage to fuel pumping and transfer systems that 
prevents fuel from reaching the engine(s). 

In-Jank Fire and Explosion. Fire ama 
explosicn can be caused by the ignition of the fuel-air 
mixture in the ullage by incendiary particles or by a hot 
tank wall. The in-tank fire or explosion can cause sukstan- 
tial damage to the tankage and adjacent structure and comro- 
nents, and the fire may quickly spread to other parts of the 
aALDCEatt. 

Void Space Fire and Explosion. This can 
re caused by fuel leakage into void spaces or dry bays 


(adjacent to punctured fuel tanks and lines) that is 
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subsequently ignited Ey incendiary particles, by het retal 
surfaces, or by the hct gases from punctured bleed air lines 
or engine cases. Fire or explosion in the enclosed sfaces 
can eventually cause significant damage to nearby subsysten 
compcnents and structure that wculd result in their failure. 
The generation of smcke and tcxic fumes may also occur and 
migrate to crew staticns, causing a possible missicn atort, 
forced landing, or aircraft abkardonment. 

Sustained Exterior Fuel Fire. Thicgieer 
mode is caused by damage to fuel tank walls resulting in 
fuel spillage onto the extericr of the aircraft which is 
subsecuently ignited, producing a sustained fire. Sometimes 
the exterior fire is snuffed cut by the airflow over the 
surface; however, tke conditior of the damaged surface, the 
altitude, and the flight speed may prevent this fron 
cccuring. 

Hydraulic Ram. Damage to container walls 
or compcnents within the container caused by the intense 
pressure waves generated in the contained liquid Ly penetra- 
tors cr fragments passing through the liquid is referred to 
as hydraulic ram damage. The fluid pressure can cause large 
cracks and gaping holes in the container walls, leading to 
excessive leakage either exterrally or internally into dry 
bays, engine inlets, e€tc.. 

(2) Propulsion System Kill Modes. The 
following kill modes of the fropulsion system have been 
cbserved. 

Fuel Ingestict. Fuel ingestion is caused 


by fuel entering the engine air inlet following rufture of 





walls that are commen to both a fuel tank and the inlet. 
Fuel ingestion effects normally include compressor surge, 
severe stall, unstakle burninc in the tail pipe, andvor 


engine flameout. 





Oe lgieoeec teen gestlonem ©Orelgn objects 
consist cf projectiles, fragments, and pieces of damaged 
aircraft components which enter the engine inlet and sursegq- 
uentiy damage the fan and ccmjressor blades. This could 
cause an engine failure or the throwing of blades through 
the engine case, leading to additional component damage. 

Inlet Flow Distortion. Distorticn cf air 
flow to the engine can be so severe as a result of conkat 
damage to the inlet that uncontrollable engine surging cr 
engine failure occurs. 

Lubrication Starvation. Penetrator, frag- 
ment, or fire damace to the lubrication circulation and 
cooling subsystem can result in loss of lubrication and 
subseguent deterioration of bearing surfaces, followed by 
engine inorerability. Loss of lubrication failures are nost 
often related to the bearings, where loss of heat removal 
eventually results in bearing s€izure. 

This kill mode is caused by peretrator or fragment fenetra- 
tion thrcugh the case, by distortion of the case, er Uby 
damaged ccmpressor blades exitirg through the case. 

Combustor Casé Perforation. penetratcr or 
fragment penetration and holing of the combustor case, with 
subsequent hot gas emission or torching through the hole, 
can cause secondary damage effects, Such as severe heating 
of adjacent fuel tanks or contrcl rods, and can also cause a 
combusticn pressure drop that may result in a significant 
loss cf engine power. 

Turbine Secticn Failure. Turbine failure 
can ke caused by fenetrator or fragment damage to the 
turbine wheels, blades, and case. This results in a lcss of 
engine fower or seccndary perforation and possiktle fire 


damage. 


a 


Exhaust Duct Failure. Penetration (ay 
penetratcrs and fragments intc the exhaust duct may result 
in damage to nozzle control lines and actuator mechanisms 
and possible fuel spillage and secondary fire if an 
augmentor is operating at the time of the hit. 

Engine Controls and Accessories Failure. 
A kill cf the contrcls and accessories can be caused Dy 
penetrator, fragment, or fire damage. The result can be 
loss of controi of the engine cr loss of one of the imnpor- 
tant accessories. 

(3) Flight Control System Kill Modes. Some 
possiktle flight contrecl kill mcdes are listed below. 

Disruption cf Control Signal Fath. 
Severence or jamming of the mechanical or electrical path 
that trarsmits the control signals Erom "the piloe tower 
contrcl surfaces or the actuatcrs can partially cr totally 
incapacitate the control system. 

Loss of Contrcl Power. Control power can 
be lest as a result of damage tc hydraulic power components 
which causes a loss cf hydraulic pressure. Tyres cf power 
system damage are thermal degradation due to fire, perfora- 
tion of hydraulic reservoirs, cylinders, or lines leading to 
aloss cf hydraulic fluid, ard deformation of hydraulic 
components, actuators, or lines that cause a hydraulic lock 
or jammed condition. 

Loss of Aircraft Motion Data. Damage to 
the aircraft motion sensors crto the sensor data signal 
faths to the flight ccntrol ccaputer can prevent the auto- 
pilot and the stability augmentation system from frorferly 
controlling the moticn of the aircraft. The results can 
vary frcem a partial loss of control, leading to a missicn 
abort, to the loss cf an out-cf-control aircraft. These 
compcnents are relatively soft and are easily damaged or 


severed Ey penetrators, fragments, and fire. 
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Damage to Centrol Surfaces and Hinges. 
Penetrators, fragments, blast, and fire damage can result in 
eivemehysical removal of a porticn or all of a flight ccentrol 
surface cr in the jamming of tte hinges, rods, and cther 
linkages tetween the serveactuators and the Ecnitrol 
surfaces. 

Hydraulic Fluid Fire. Fires can result 
from the ignition of fressurized or gravity-leaked hydraulic 
fluid, and smoke or texic fumes from the fire can affect the 
crew. 

(4) Po 


wer 2 
System Kill Modes. Some of the possitle kill 
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modes within the power train and rotor blade system of heli- 
copters) and propeller driver fixed-wing aircraft are 
descrited below. 


This kill mode can 
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occur due to projectile or fragment perforation of cil or 
grease ccntaining components, with subseguent loss of lubri- 
cation oil or grease. Lubrication starvation is esrecially 
critical in oil-cooled helicopter transmissions, where the 
oil systems are not self-contained and usually consist of 
externally mounted components, Such as sumps, filters, 
coolers, and interccnnecting lines and hoses. Loss of 
lubrication prevents the removal of heat and lubrication cf 
rubbing surfaces, which eventually results in ccmpecnent 
seizure. In helicogter trans@rissions and gear boxes, fail- 
ures are often catastrophic, causing case rupture and fire 
after input pinion failures and rotor blade seizure after 
planetary assembly failures. 

Mechanical/Structural Damage. Mechanical 
or structural failure of power train components can be 
caused by fragment and penetratcr inpact or penetration, ofr 
ky fire. Bearings, gears, ard shafts are prone to damage 


and failure when hit, shafts can be severed, and rearings 


Sa 


and gears can jam. Chips and debris from damaged compcnents 
or structure can jam the o11 pulp, ~ causing loss of lubrica. 
C1 On Rotor blades and propellers when hit can result in 
rotor unkalance, blade instability, blade out-of-track, and 
loss seis fe Rotor unbalance is perhaps the most critical 
consequence of ballistic damage and occurs when a portion of 
the -Elade 1S removed. This lcss of mass in one [lade can 
cause large, alternating hub fcrces and intense cockpit and 
contrel vikrations, leading to structural failure or loss of 
GCOntEol. Blade instability is caused by a reduction of 
Elade stifiness due to damage and can result in severe 
flutter cr divergent pitch oscillation that can be cata- 
strorpic. Blade out-of-track is usually aless severe 
result cf the reduction of blade stiffness, hut it could 
result in blade contact with the fuselage. Although scre 
loss of lift normally accompanies any ballistic damage, the 
consequences are usually not as catastrophic as those asso- 
Clated with the other types of ITlade reactions. 

(5) Crew System Kill Modes. The inability of 
the pilot and his or her replacement to operate the aircraft 
Eecause cf injury, incapacitation, or death will usually 
lead to an aircraft kill in a very short period of time. 

(6) Structural System Kill Modes. The struee 
tural system is usually the toughest system on the aircraft. 
However, structural damage car be sufficient to cause an 
alILCrdiiee «he. Some possible structural kill modes are 
listed Lreélow. 

Structure Remcval. Physical severence or 
complete loss of large portions of the load-carrying 
aircraft structure caused by multiple penetrators and frag- 
ments, klast, fire, or radiation effects can result in 
either an immediate cr a delayec aircraft loss. 

Pressure Overload. Immediate failure or 


subseguent failure urder maneuver loads can be caused by 
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external blast effects which result in over-stressing the 
meade CaLrying structtre. 

Thermal Weakening. Structural failure can 
occur to portions of the load-carrying structure as a result 
of internal void space fires, eiternally sustained fires, or 
radiation over a portion of the aircraft surface. 

Penetration. A single penetration of one 
load-carrying member will usvally not cause structural 
failure; several memrers must be penetrated or cut Lefcre 
fore Can OCCcUr. Since the likelihood of structural 
failure from penetration by a few fragments cr armcr- 
piercing projectiles is extremely snall, tis) typeof 
failure would most likely result from continuous rod warhead 
effects. 


(7) Electrical Power System Kill Modes. The 





failure of electrical system components is due to _ the 
severing or grounding of electrical circuits, the destruc- 
tion or unbalancing of rotating components, such as genera- 
tors and alternators, and the fenetration or overheating of 
katteries. 

(8) Armament System Kill Modes. Two major 
reactions can occur when gun amnunition, bombs, rockets, and 
missiles are hit by a damage mechanisn. One 1S a sustained 
fire in the magazine that could cause cook-off or detonation 
of the stored ammunition, and the other is a sé€évere explo- 
sion of either the argament or the propellant. 

(9) Avicnics System Kill Modes. Avicnics 
components are usually very soft and are easily damaged by 
penetrators and fragments, blast, radiation, and thernal 
hazards, such as fire or hot gas torching. Their kill node 
is usually failure to operate, although a degraded oferation 


1s possitfle. 
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€. Fault Tree Analvsis (FTA) 


As descriked in the preceding section, the FMEA 
is a Eottom-up approach to determine an aircraft's critical 
components. In the FMEA, the failure of a compenent is 
assumed and the consecuences of that failure are identified. 
Another frocedure for identifying critical components is the 
Fault Tree Analysis. The FTA is a top-down approach which 
starts with an undesired event and then determines what 
event or combinaticn of events can cause the undesired 
event. The Fault Tree Analysis is one of the princifal 
methods of system safety analysis, and can include both 
hardware failures and human effects. The generic fault tree 
diagram shewn in Figure 2.7 demcnstrates the logic symbclogy 
used in the Fault Tree Analysis. 

The undesired event U can only occur when event 
A and event B occurs. (This is the logical AND gate). Event 
A can occur when event C or evert D occurs, or if both event 
C and event D occurs. (This is the inclusive OR gate). 
Event B can occur when event F or event F occurs, but not 
when kLoth event E and event F cccurs. (This is the exclusive 
CR gate). Because the undesired events of interest here are 
failures caused by camage, the FTA will be referred to as 
the Damage Tree Analysis. 

A portion of a damage tree diagram for a twin- 


engine aircraft with a single fuel supply source tc both 


engines is illustrated in Figure 2.8c. The undesired event 
is an alEGEatt -attrationscns.. An attrition kill cccurs sig 
the aircraft can neither fly nor land. The aircraft cannot 


Fly if 1t loses lift, of theust,, GF Controle Loss Cl curios 
will cccur when both engines fail or when the common fuel 
supply tc both engines fails. leakage from damage caused by 
penetraticn or hydraulic ram from the feed tank that 


Supplies fuel to both engines will cause the fuel system to 


aie 





UNDESIRED 
EVENT U 


EVENT A 


EVENTC EVENT D 





Figure 2.7 A Generic Fault Tree Diagran 


maa]. The left ergine can fail due to engine damage or the 
loss cf the left engine fuel supply. The left engine fuel 
Supply system can fail due to penetration of many cf the 
fuel transfer componerts frem the feed tanks to the engine 
combustor, or these components can fail due to fire caused 
Ey leaking fuel, leaking hydraulic fluid, ora holed ccnku- 
stor. The left engine can fail due to damage caused Ly fuel 


ingestion, penetraticn of the engine compressor, combustor, 


ao 


Or tuba ne, loss of DTubmieyeiecn, fire caused by leaking 


fuel, or damage to the engine ccntrols or accessories. 
f. Kill Trees and Kill Expressions 


Results cf the sters described above leads to 
the identification of a set cf critical components in a 


particular aircraft design, for a specific operational mode 


ATTRITION 
KILL 


AIRCRAFT AIRCRAFT 
CANNOT FLY CANNOT LAND 


LOSS OF RGSSUr LOSS OF 
LIFT TERUST CONTROL 


Figure 2. 8a Portion of a Damage Tree Diagran 
for a Twin Engine Aircraft 
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and selected kill level. Each critical component either 
makes a singular contribution to an essential functicn or 
€ach ccmronent 1S one of two or more redundant ccmpecnents, 
each cf which can mgake the necessary contribution. The 
distinction between nonredundant critical components and 
redundant critical ccmponents is extremely important and 


will ke demonstrated in the following sections. 


(1) Typical Critical Components. For a two 
engine, single pilot helicopter, the following nonredundant 
compcnents are potential critical components for an attri- 
ean Kili: (1) Flight control system components (reds, rod 
ends, bellcranks, fitch links, swashplate, hydraulic actua- 
tors, ccllective lever, and control pedals), (2) ROCCE 
Elade and power train componerts (blades, drive shafts, 
rotor heads, main transmission, and gear boxes), (3) Fuel 
system ccmponents (fuel cells, the sump, lines, and valves), 
(eerilot, and (5) Tail boon. 


The followinc redundant components are 


potential critical components for an attrition kill: (1) 
Propulsion system ccmponents (engine and engine mounts), 
(2) Hydraulic subsystem compcrents, and (3) Struerurast 


elements. 

For a single engine, single pilot, f1ixed- 
pomg aircraft, some potential redundant and nonredundant 
critical components are: (1) Pilot, Cyr Mergnt Contrcls in 
mmemmecekrit and the pitch axis flight control components, 
(3) Hydraulic reservcirs, high-pressure lines, components 
and actuators, (4) All fuel tarks, components, lines, and 
Shut-cff valves, (5) Engine far, compressor, turbine, and 
combustor sections, drive shaft and bearings, engine mcunts, 
and the lurkrication and fuel surply components, (6) Major 
structure, such as wing box spars, fuselage longerons, and 
the herizontal and vertical stabilizer spars and attach- 
ments, (7) External ordnance and the ammunition storage 
drum, (8) Liquid oxygen (LOX) bottle and components, and 
(9) Liguid-cooled avicnics with a flammable coolant. 

(2) The Kill Tree. A visual illustraticn of 
the critical components and of the contribution cf component 
redundancy is provided by the kill tree. timeorder toe Kilt 
the aircraft a complete cut through the tree trunk is 


required. A sample kill tree for a two engine, two filot 
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heliccfpter is shown i1neeegures2.o- For example, according 
to the kill tree in Figurpe 2.¢, a less Of Giewep.  cvrscme 
either the co-pilot or the co-filot'ts controls will lead to 
an aircraft kill, as willa lcss of the drive train or loss 
c£ fuel feed. 

(3) The Kill ExELession. The relationship 
rketween component loss and an aircraft kill can be expressed 
using the logical AND and OR statements. This lcegigas 
expressicn 1s called the kill expression. AS an example, a 
porticn of the kill expression for the kill tree depicted in 
Figure 2.9 is “given by: 

[(Pilot .OR. Pilot Contrels) .AND. (Copilot 
-OK. Copiloty CenteEows es One (Engine 1 .AND. 
SOF (Drive Train) aChe etc: 


C. VULNERABILITY ASSESSMENT 
1. Defining a Vulnerability Assessment 


A vulnerability assessrent is the process of deter- 
mining numerical values for the measures of vulnerability. 
Target vulnerability analysis 1s a scientific discifline 
involving both experimental and analytical processes. 
Preliminary theories which attempt to describe the resfonse 
of a target to a particular tkreat 1s accomplished during 
the analysis. Experimentaticn provides the data used to 


corrokorate or repudiate the theories developed during anal- 


ysis. Target vulnerability ccncepts are based or funda- 
mental physical principles. These principles include the 
theory of: hydrauljec@ran, chile hons Crack propagatimenm 


engine response to fuel ingestion, and structural response 
to blast and penetration. Vulnerability assessments may be 
carried out entirely "by hand", or one or more computer 
programs may be used. Assessments are usually conducted to 


help the designer evaluate the wulnerability of a design, or 
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more impcrtantly, by the military to predict the response of 
targets toa particular threat before threat and target 
engagement. 

A vulnerability assessment is carried out at cne of 
three general levels cf detail. These levels are estimates, 
evaluaticns, and analyses. Mcst assessments consider five 
fragment impact velccities fren 1000 to 10,000 ft/sec and 
use aS a Minimum, the six cardinal aspects. For a mininun 
level assessment, the six major aspects shown in Figure 2.10 
are usually considered for each kill level. The 26 asfects 
depicted in Figure 2.11 are usually considered when a mere 
detailed analysis cr a computer analysis is perfcrmed. 
Estimates typically use simple equations for the aircraft 
vulnerakrility measures that are functions of a few major 
parameters. These equations are referred to as regression 
equations if they are fitted tc historical data on several 
aLECrat t- Yor sstow thc results from engineering studies. 
Evaluations are more detailed than estimates and may include 
such items as the individual component locations, sizes, and 
vulnerakility measures. Analyses are very detailed assess- 
ment studies that use specific technical and functional 
information about tke components and their vulnerability. 
Analyses are usually conducted on a digital computer using 


complex gecmetric tarcet models. 
2. Vulnerability Measures 


Because of tre diverse nature of the hostile envi- 
ronment in which aircraft operate, the measures of the 
vulnerability of an aircraft vary with the type of threat 
encountered. For example, if a hit on the aircraft nuse 
occur in crder for a threat to ke effective, such as a small 
arms fro7ectile and a contact-fuzed high explosive warhead, 
one measure of vulnerability is the conditional prokability 


the aircraft is killed given a random hit on the aircraft, 
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26 Aircraft Aspects for a Detailed Analysis 


Figure 2.11 


a Another measure of vulnerability to impacting damage 
mechanisms is the aircraft's vulnerable area, A, - 
Vulnerarkle area is a theoretical, non-unique area presented 
to the threat which, if hit Ey a damage mechanism, would 
Besmet in ah aircraft kill. Cr the other hand, when damage 
is caused by the effects of a rearby high explosive detona- 
tion, the vulnerability may be expressed inthe fcrm of a 
PR/D (probability of kill given a detonation) envelope. 
This envelcpe represents a kill probability contour about 
the aircraft on which a specified detonation will result in 
ameeetain probability of aircraft kill. If only the Elast 
from the exploding warhead is considered, the envelope 
represents the aircraft's vulnerability to external [Elast. 
A measurement which is becoming more important relates to 
aircraft vulnerability to a laser threat. Laser vulner- 
ability can be measured by the frobability of kill, given a 
specific power laser lock-on fer a specified period of timze, 


2 K/Lo ~ 


3. General Requirements 


Certain required elements of a vulnerability assess- 
ment are common to all studies, regardless of the tyfe of 
threat ccnsidered. These elements are: (1) a selecticn of 
the aircraft kill levels or categories to be assessed, (2) 
an assemkly of the technical ard functional descripticns of 
the aircraft, (3) a determinaticn of the critical components 
of the aircraft, (4) a selecticr of the specific threats the 
system will encounter, (5) an analysis to identify the type 
and amount of damage required to kill each critical ccmfo- 


nent, and (6) the computatior of the appropriate vulner- 


Stemi ty measures for the components and the aircraft tLased 


upon the threat selected. Tke first three steps of the 
assessment have been described in the preceding section. A 


presentation of the last three steps follows. 


a. Threat Selection 


Because of the many diverse and terminal effects 
of the various damage mechanisms, each vulnerability assess- 
ment is usually made considerince either a specific threat or 
a specific damage mechanisn. Mechanisms which may cause 
damage to an aircraft may be classified as: kinetic energy 
penetratcrs such as projectiles and fragments, internal and 
external blast, pyrcphorics, shaped charged jets, focused 
rElast fragments and lasers. 


Kinetic energy penetrators include, but are not 


limited to, ball prejectiles, armor piercing. projectiles, 
and fragments. These penetratcrs cause damage to aircraft 
components during fenetration and perforation. ALMOr 


piercing projectiles are constructed with a hardened core 
which enhances the fenetraticr characteristics of these 
projectiles over those of the tall type. Most small armor 
piercing projectiles are prone to tumbling after impact 
thereby increasing the size of the hole that they tear in 
the internal components. | 

Armor piercing incerdiary projectiles contain an 
incendiary ix encased within the nose of the projectile 
ahead of a hardened case. Upon impact the jacket feels off, 
and the incendiary material flashes as the projectile core 
penetrates the target. 

Large high explosive projectiles and missiles 
can be equipped with influence cr command fuzes causing tkem 
to detonate nearby an aircraft. These projectiles of 
Missiles have the capability of inflicting damage from 
external blast effects, fragment impact effects, or a ccombi- 
Na ticnmet been. 

Many smaller high explosive projectiles are 
eguipred with delay fuzes. These fuzes initiate ufon 


contact with the aircraft skin and detonate the projectile 


7C¢ 





Meena 6tthe)6cAarrcraft. Das high explosive detonation 
Froduces internal blast and fragmentation effects. These 
fragments usually are smaller and slower than the larger 
high explosive projectiles but the proximity of the detona- 
tion tc the critical components resultS in a spray of many 
fragments impacting the components. Mis GCOnDination of 
internal blast and fragmentation effects is especially 
lethal to lightly ccrstructed components such as oil and 
fuel lines, oil and fuel tanks, hydraulic tanks, and the 


alrcrew. 
bk. Critical Component kill Criteria 


Once the set of critical components for a given 
aircraft has been identified, the damage or kill criteria 
for each of the failure modes of these components must be 
determined for the selected threats. Damage criteria for a 
critical component is the level of damage required fora 
preestarlished degradation of the performance of the ccmfo- 
nent. Thus, a kill criterion is the specific descriftive 
characteristics or quantification of a component failure. 
Some €xamples of critical compcrent kill criteria are: the 
amount cf material that must Fe removed from a drive shaft 
foc. failure, requirements fcr failure of a structural 
member, the amount cf damage required to incapacitate a 
system of gears, the minimum diameter of hole in a fuel tank 
or line for engine starvaticr within a specified time 
period, etc. Very few kill criteria are precisely known, 
nor can they easily te determired. Battle damage reforts 
are an important source of compcnent damage effects infcrma- 
iO Tl The results of tests conducted on all tvpes of 
aircraft components and subsystems provide another increas- 
ingly inportant and expanding source of data. Data is 
required for each critical component that allows for the 


effects cf encounter farameter variations, such as fragment 
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or penetrator striking velocity, obliquity angle, share and 
mass cf the fragment cr penetrator, to be estimated for each 
kill category and level being assessed. In the case of 
externally detonating warheads, high explosive prcjectiles, 
and contact-fuzed rissiles, miss distance koundaries 
relating Pe to burst points are established to assess 
Elast effects of these threats. 

The major result of this task is the specifica- 
tion of numerical values for the kill criteria for each 
failure rode for each critical component for each ttkreat to 
be considered. Three specific kill criteria are currently 
in use fcr the impacting damage mechanisms. They are the 
probakility of component kill given a hit, the area removal 
criterion, and the energy density criterion. There asa 
fourth criterion which applies to the blast damage 
mecharisms. 

(1) The Probability of Kili Giver” aye 

Punetion: The a function defines the 
probability of a compenent kill when impacted by a fragment 
cr penetrator. This criterion can be presented grafhically 
as a function of the mass and velocity of the damage mecha- 
nism, or it can be expressed in an analytical form. Figure 
z-12 is a sample of Pe /h data ficr a flight -eontrol your 

The P 


k/h 
components that can ke killed Ey a Single hit, such as crew 


criterion is normally used for 


members, control rods, electronic eguipment, and servoactua- 
tors. These components are scnetimes referred to as single 
fragment vulnerable components. It can also be used for 
some cf the larger components, such as engines and fuel 
tanks. In this case, the volume of the large component is 
usually divided intc several Smaller volumes, and a 
different numerical value of Pom is assigned to €éach 
volume. For example, a fuel tank could be divided into the 


ullage, fuel, and external vcid spaces, and a turtojet 


TZ 


Smereme  CCUlGd be Stldivided intc the major sections illus- 
Madieed in Figure 2.13. 


The determination of the Pom i Clee AG ti 
compenent or part cf a component isa very difficuit under- 
tact pg. It reguires a combination of critical compcnent 
analysis data and sound engireering judgment. Although 
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Figure 2.12 Typical P,,, Data for a Flight Contrel Rod 
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limited gunfire testing provides some insight intc the 
effects cf projectile and fragment damage potential, there 
is no universai methodology fcr arriving at a numerical 
value fcr Pins Tre larger ccmponents, such as the fuel 
tanks and engines, are especially difficult to evaluate due 
to the multitude of local ervironments, the constantly 
changing operation conditions, and the many different 
failure rodes. Numkers for E&k,;, are eventually assigned 
bkased upon a combination of empirical information, eéngi- 
neering judgment, and experience. 

The location of the component inside the 
aircraft will have an influence on its ultimate numerical 
puoe@attility of kill given a hit, but not on its Py,, func~ 
TTOD. Components located behind thick structures cr dense 
equipment packs will receive a level of protection due to 
the slowdcwn of the damage mechanism as it attempts tc fene- 
trate the shielding ccmponents. The numerical value of the 
Py /h for the lowered velocity of impact will generally be 
less than the Pin fer the impact of a penetrator cr frag- 
ment that was not slowed down. Other considerations, such 
as spall and fragment breakup caused by the intervening 
components also becomes important. 

The area removal criterion defines a 
specific amount of area that must be removed from a ccmfo- 
nent in order to kill that ccuaponent. Ditomeeer terion 1s 
applicable to large penetrators, such as rods, and to the 
closely spaced hits from many fragments. Tiestotal CCHEO- 
nent damage from a ccllection of closely spaced hits can be 
greater than the sum cf the individual damages from the same 
number of widely spaced hits. Cften there is a synergism of 
damage due to cracking and rfetalling between the individual 
holes, and large areas of component structure can te removed 
or destrcyed. This criterion is used mainly for structural 


components. 
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(2) Energy Density. In this “Critesmaon, a 
component kill is expressed in terms of a required mininun 
component surface area that omtrst be exposed to a mininun 
threshold level of the kinetic energy density of the 
impacting damage mechanisms. This criterion is applicable 
to clcsely spaced multiple fragment hits and is used for the 
structural components, as well as other large components, 
such as tke fuel tarks and engines. For some ccmponents, 
there may be a mininum mass of the damage mechanism Lelow 
which the criterion is not apflied. 

(3) Blast. The damage criterion for bles 
generally the critical values of pressure and impulse cn an 
aircraft surface necessary to cause the specific compecnent 
damage level associated with tke assumed kill level. FoR 
example, a dynamic cverpressure of two poundS fer square 
inch cver the upper surface cfa horizontal tail for one 
Hilliseccnd may be sufficient tc cause crushing of the skin, 
leading to a loss of stiffness and the inability to sufport 
the flight loads. Although this criterion is usually 
applied to the structural compcnents and control surfaces, 
the effects of the blast can extend into the interior of the 
aircraft and can damace electrical wiring, hydraulic lines, 
fuel tank walls, and cther internal components lccated close 
to the@errerar. sskin. 


c. Computaticn of the Vulnerability Measures 


The procedures used to compute the vulnerability 
of an aircraft and its components to an externally deto- 
nating high explosive warhead and non-explosive penetrators 
or fragments, to an internally detonating high explcsive 
warhead, and to lasers are described in the following three 


secticns. 
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De. VULNERABILITY TO EXTERNALLY DETONATING WARHEADS 


Vulnerability of an aircraft to an externally detonating 
high explosive warhead is usually analyzed in two  stefs. 
The first step is a determination of the aircraft's vulner- 
ability to the blast, and the second step analyzes’ the 
aircraft's vulnerability to the fragments and penetrators. 
In addition, both analyses must consider the encounter scen- 
ario retween the aircraft and the missile at the time of 
warhead detonation. For this reason, this section has been 
divided inte the following twce subsections: the effect of 
fragments and penetrators striking an aircraft, and [Elast. 
Shortly after detonation, the Elast front precedes the frag- 
ments. Eventually, the fragments pass through the frlast 
front because the fragment velccity decay is less than the 
blast front velocity decay. The overpressure caused by the 
warhead detonation can cause serious damage to aircraft 
structure and components. Using the conditions of the 
encounter scenario, the blast is analyzed for impulse and 
overpressure to determine iso-damage contours for an 
Semerdart kill. If a detonation occurs close encugh to 
inflict serious blast damage, tke fragments most likely will 
cause much more damage than that caused by the blast. fer 
the fragments and penetrators subsection, the vulnerability 
to fragments and penetrators is computed for both the single 
hit case and the multiple hit case. A typical encounter is 


shown in Figure 2.14. 


1. Effect of Fragments/Fenetrators Striking an Aircraft 


The vulnerability of an Hceceartieioey, a Single 
impacting penetrator cr fragmert is usually expressed asa 
becas Vulnerable area, Ay, OF aS a probability of aircraft 
Pete given a random hit on the aircraft, Py}. The vulner- 
able area concept is applicable to both the aircraft and to 


oa 
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Figure 2.14 pecan Aircraft Encounter With 
An Externally Detonating HE Warhead 
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Pesmeritical components. The vulnerable area of the typical 
femeectrpcnent is dencted by A vi! and the component kill 
critericn used is’ the probability Ofeellie ormven a hit 

Push ; 
tion used in this presentation, the variable and subscript 


To assist tke reader in keeping track of the nota- 


Gefiniticns are Summarized in Table 2. 


SS EES ee ee ee eS GEE eS ee i OO es GE ee ee SES 


, 


TABLE 2 


Vulnerability Assessment Variable Definitions 


Definition Varialle 
oti ity Of Kitt ing the ith component tae 
given a hit on the ith compecnent i 
eee tty of killing the ith component Pay 
even a hit on the aircraft i 
Peobcability of killing the eircraft Pay 

| given a hit on tte aircraft 
| Vulnerakle area of the ith component Ay. 
| Vulnerable area cf the aircraft A, 
Presented area of the ith ccmponent or 
a 
Presented area of the aircraft Ap 
| 


Note that a distinction is made between component 
and aircraft ee vaitiables by using lower 
and upper case subscripts, respectively. 


eee 


The vulnerable area of the ith component is defined 
as the product of the presented area of the compecnert in the 
plane normal to the approach direction of the damage mecha- 
nism (the shotline), Anis and the probability of kill cf the 


a 
component given a hit on the ccmponent, P,,,,- Thus, 
ae 
A = A x P (a) 


1 Py n/a 


ve 


Since tEoth bo and Fuh: are generally functions of the 
ee ek x 

threat direction or aspect, the vulnerable area will also 

vary with aspect. In the discussion that follows, it is 


important to recall that: 


Py ieee eee (2225 
where P is the probability the aircrait or ccmEecneHe 
survives the hit, and BH is the probability of killing 


that aircraft or comfrcnent. 
The kill prokability of the ith component givena 


random hit on the aircraft, Poy. 1s: 
ae 


Pp = Pp. x P 223 


where Ph/H; is the prcebability the component is hit givena 
hit on the aircraft, and P;,,. is defined as the probability 
the ccmfonent is killed given a hit on the component. From 
Equaticn 2.2,-42t f£cllews ena. 


Es/Hy (1a emer (2.4) 
Using Equations 2.77 and 2.3, anc sOlvmnge or Pi/H. gives: 
ee 
Pju, = Ap, 7 4p (225) 
where Ap is the presented area of the total aircraft in the 
plane ncermal to the threat direction. Substituting 
Eguations 2.5 and 2.1 into Equation 2.3 determines, for any 


ranionm hit on the aircraft, tke probability the ith ccmfo- 


nent is killed, and is given by: 


PyesH, = Ay. 7 Ap (2.6) 
ae J 
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The numerical value _ for P/E, depends ufpecr the 
presented area of the critical component, Ap.s and of the 
aircraft, Ap, and upon the comprcnent kill criterion, Pk/hs 
The presented area of the critical components and of the 
aircraft can be otktained frem the available techrical 
description of the aircraft. The procedure for determining 
the numerical value for Pxsh; is described in the presenta- 
tion on the critical component kill criteria given atrove. 

In this assessment, a component is assumed _ to be 
€ither operating and performing all of its functions ofr 
killed. No degradaticn of compcnent capabilities is ccnsid- 
ered due to a hit, and no compounding of component damage is 
recognized. Althougk these assumptions are usually made in 
a vulnerability assessment, they are not necessary. 
Theoretically, only the component hit can be killed. 
Although the kill of adjacent ccmponents, perhaps by fire or 
explosicn, is not directly considered here, a procedure for 
indirectly accounting for kills of adjacent components will 
ke described later. 

Now that the concepts of vulnerable area and _ the 
probability of kill given a hit have been explained, the 
scenario must be considered. In any given combat engage- 
ment, tke aircraft will either not be hit, it will be hit 
only cnce, or the aircraft will be hit more than once. The 
no hit situation is not of interest here. The locaticn on 
the presented area of the aircraft of the single hit and of 
multiple hits is assumed in the vulnerability assessment to 
ke a random distribution, with each damage mechanism having 
the same approach or attack direction. In cther words, the 
assumpticn is usually made that the enemy has no cafability 
to direct hits to any one particular component, subsysten, 
cr part of the aircraft, and that the damage mechanisms 
travel along parallel shotlines. The single hit case lays 


the ground work for the multiple hit case. In both cases, 
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the influence of nonredundancy and redundancy of ccmronents 
on the vulnerable area must be examined. Overlap ci craGe 


ical comfonents is also an important consideration. 
a. Single Hit Vulneratility 


Both the nonredundant aircraft model and the 
redundant aircraft model considered in this section are 
assumed to receive orly one hit. The nonredundant aircraft 
model is composed of cnly one of each of the critical ccmfo- 
nents. Thus, the lcss of any one critical component will 
cause the loss of the aircraft. In the redundant aircraft 
model, scme of the critical ccmponent functions are dus la 
cated by the same or different components. The effects of 
overlapping of both nonredundant and redundant critical 
components are examined. For example, the fact that an 
engine cverlaps (shields) a hydraulic pump will frotably 
decrease the probability of kill of that pump. It is neces- 
sary to specify how this overlap effect is quantified for 
both the nonredundant and redundant aircraft models. 


(1) Aircraft Model Composed of Nonredundant 


ix | 


Components with No Qverlap. This aircraft 
consists of N critical components whose functions are not 
duplicated by any other compecnent. The components are 
arranged in such a way that nc components overlap when 
viewed from a given aspect. Any hit on the aircraft takes 
place along a shotlire that passes completely through the 
alLEC radia. Thus, no more than one component can be hit cn 
any one shotline. As an exauple, Figure 2.15 shows an 
aircraft consisting of three critical components; a plore 
one fuel tank, and one engine. None of the critical ccmfo- 
nents overlap in the aspect presented in Figure 2.15. 

The probability of killing this aireratee 
given a random hit on the preserted area in Figure 2.15, can 


ke derived using the kill expression and Equations 2.1 and 


de{TToeaO ON YIM TAPOW FFeTDATY PUepUNpSTIUON 
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Zee Fcr an aircraft composed of N mnenredund aivemcr1 t1 cam 


components, the kill expression is: 
Kill = (Nrel) .OR. “{(Nre2eoc.OR. Sos einen (2290 


where Nrei refers toa kill of the ith nonredundant ccnmfo- 
nent. In other words the aircraft kill is defined by the 
kill of nonredundant component number 1, or nonredundant 
component number 2, cr ..., or nonredundant component number 
N. Fecause a kill cf any cne of the critical components 
will kill the aircraft, the aircraft will survive only if 


all of the nonredundant critical] components survive. Thus, 


P = P x P X° ree & SE {2535 
7H S/H. S/Hy 


Using Equation 2.4, Eguation 2.€& may be written as: 


Poa = (l= P ya, ? 57 ie See x (253 


one! Xe Piya, ) 


For our model aircraft N=3, and Eguation 2.9 becomes: 


eae PH i *k/H, : */H at (la 
Lae) (Ey ee Pk /H3 ) (PH a 
Px/H3 ) ~ (Pkyn, * Fxyoy X¥ Pryu3 ) 


Because of the assumftion that cnly the component hit can be 
killed, and because necne of the critical components cverlap, 
the kills of the components are mutually exclusive. This 
means only cne component can be killed by one hit, and the 
Froducts of the la given in Eguation 2.10 are not aprpli- 
cable. Therefore, Equation 2.1C simplifies to: 


) = j1- { (2 od 


Pee,” Paya * Feyay ? 


84 





pemmetene ELObability cf killing the aircraft given a hit on 
fremaircrart is just the sum of the individual protatilities 
of killing each of tke critical components given a randon 


hit or the aircraft. This may te written as: 


Pe = Pxyn, + Px/ty * -+- * Ex/ty (Dare) 


Pieeeituting Equation 2.6 into Equation 2.8, and applying 


the ccncert of P expressed ir Equation 2.1, leads to: 


/h 


P aes / A (2. 13) 
where A is the summation of vulnerable area of all of the 
critical components. 

For our example aircraft, the kill expres- 
Sion iS given by: 


Kill = (Pilot) .OR. (Fuel Tank) .OR. (Engine) (2. 14) 


mean EQGUuation 2.12: 


P = Pp + Pp + Pp (2.515%) 
K/H k/H, k/H k/H, 
and 
fees ty tf (2. 16) 
p ie me 


where the subscripts pf, £f, and e€ denote the pilot, the fuel 
tank, and the engine. From Fquation 2.1, the irdividual 
compcrent areas are given by: 


A = A x P (2.2640) 


A = A oN (2a) 


Be 


A = A x P (23°99) 


For illustration, a numerical example is 


presented in Table 3. 


| TABLE 3 | 
Nonredundant Model Without Overlap | 

| With Mutually Exclusive Kill Modes | 
| Critical A x P = A p 
| Ccmrponent Pi a i eo | 
Pilot 4 ft2 tO 4 ft2 sO 133 ! 
| Fuel S0esrt- G3 18 £t2 a0 200 | 
| Engine 50 £t? 0.6 30 zits - 1000 | 
| A = 300 ft2 A = &2 £t? P = .1733 | 
P V K/H | 

se Z Jw 





The kill of cre critical component due to 
damage caused by a hit on another critical component and the 
consideration of multiple kill nodes of a critical component 
can Ee indirectly accounted for, in this model, by 
increasing the numerical value cf the kill critericn for the 
component hit. Consider two failure modes that are not 
mutually exclusive, that is, foth can occur with a single 
Halters For example, suppose the probability the fuel tank of 
an aircraft is destrcyed by a fire when the fuel tank is 
hit, is taken as 0.3. Suppose further that the probability 
that the fuel tank is penetrated and that hydraulic fran 
damage causes fuel to be dumped into the air inlet and 
ingested ry the engine, leadirg to an aircraft loss, is 


taken as 0.1. The aircraft will survive a hit in the fuel 


86 


tameemecniy if there is nezther a fire nor any fuel ingesticn. 
The protability that neither of these failure modes cccur 
when the fuel tank is hit is civen by the product cf the 
Peerage ility that there is no fire (1- 0.3), and the fprob- 
ability that there is no fuel ingestion kill of the engine 
ieee 0. 1), which is 0.63. Therefore, the probability that 
there will be a fire kill anc/or a fuel ingestion kill, 
given a hit on the fuel tank, is given by (1 - 0.63), or 


C.37. A numerical example is presented in Table 4. 


TABLE 4& 


ndant Model Without Overlap 
tually Inclvsive Kill Modes 


| 
| 
| 
| 
| 
ae 


=o 


Nonr 
With 


Critical A x P = A P 
Component Py k/ny Vi k/Ai 


— > <P ae a ca ca ce <P —_— =e <P a = — <P <a << a —= <2) ca ce «ee oo “eae <P << 


Eee 4 fte 3 4.0 ft? SO) ss 
Fuel 60 ft? ere a Pie 2 Et -0740 
Engine S00 hus 0.6 30.0 £t? - 1000 


A. = 300 £t? A. =s5 0.2 Ete ie = .1873 


| P V K/H 
= 


Ce ae ee ec a es ee 


Note that in this case the Poh Le New 
the sum cf the two individual kill probabilities because 
there can be both a fire kill and a fuel ingestion kill on 
the one hit. Comparing Table = with Table 4 shows that by 
accounting for the additional failure mode of fuel irgestion 
by the engine increases the fuel tank Pe 7h with the acccmpa- 
Nhying change in compcnent and aircraft vulnerable area, and 
Biescompcnent and aircraft probability of kill. This same 
Frocedure can be used to compute the Pk shy due to multifle 


failure modes of one critical ccmponent. 


Si 


Composed of Nonredundant 
Comrenen lage The aircraft 
model will now be expanded by allowing two or more critical 
compcnents to overlafr in an arkitrary manner. An example 
aircraft is presented in Figure 2.16. There can be any 
number of critical ccmponents along a shotline within the 
cverlap area. For the aircraft to survive a hit aleng a 
shotline within a region of N overlapping critical comfo- 
nents, each critical component along that shotline must 
survive. The probability the aircraft survives a hit on the 


cverlafp region, P ; Se Gaaviemeroy. 
s/Nyg 


Because two or more critical components in the overlap 
regicn can be killed Ey one hit, the kills of more than cne 
compcnent are not mutually exclusive. In this case, 
Equation 2.11 is not valid, and Equation 2.20 must be used 
for hits in the overlap region. For the aircrait 27700 
trated in Figure 2.16, the protability the aircraft survives 
a hit on the overlap region is given by Equation 2.21, where 
the subscripts f and erefer to the fuel tank and the 


engine. 


P . = Pp X Ps/Ye (2.219 


If the overlarzr area, A , 1s new consid- 
O 
ered as a separate ccmponent, the probability of kill given 


a hit on the component may be written as: 


O 


Sie 
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and tke vulnerable area of the cverlaptaves eee ae 
O 


ee eae (2225) 
V2 pe k/N, 
Substituting Equation 2.21 @inte. Bqugticue2- 7a, and using 


Eguation 2.4, gives: 


Bo Pym) x (1- a aa (2.265 


O . 


It 1s assumed for this example that the 


overlap area in Figure 2.16 is 10 ft?, the fuel tank Fm is 
0.3, the engine Pym is 0.6, and all other areas are the 
Same as used in the nonoverlafping example. The fuel is 


assumed tc slow the damage mechanism down, but not enough to 
change the engine PR. jp - Becatse the Rs, values are the 
same as in the nonoverlapping example, any reduction ir the 
vulnerable area of tke aircraft is due only to the component 


overlap. Thus, in the overlap region: 


Pyne = 1 = [ (1-0.3) 2080) eae iz (2. 25) 
and 
A = 10 x 0.72 = ¥.2 Ete (25.26) 


O 


according to Equations 2.23 e2nGder1c4- 

The vulnerable area of the overlap area 
contributes to the aircraft vulrerable area. However, over- 
lapping alsc reguires that the overlap area be suktracted 
from the total presented area cf each overlapping ccmponent 
contributing to the overlap. The component area outside o£ 
the cverlap is treated in the usual way. Table 5 aillus- 


trates ccmputing the vulnerable area of an aircraft with 


oe 


overlapping components. Note tkat locating two of the crit- 
ical comfonents such that one overlaps the other reduces the 
mmmeerart vulnerable area form 52 £t2 to 50.2 £t?-. This is 
an example of how lccation of the critical components can 


reduce tke aircraft's vulnerable area. 


| LAD eS | 

| Vulnerable Area Computation for Nonredundant | 

| Model With Overlap ard No Engine Fire 

Gritical A x P = A 

Ccmpfonent aa AES a | 

Pilot 4 ft? 1.0 4.0 £té | 

Fuel 60-10=50 ft? Oe3 Oe ee ! 

] Engine 50-10=40 ft? 0.6 24.0 ft? | 
Overlap 

| Area 10 £t2 ee Ga.2 Aiea | 

= 2 

| AL, eZ | 

& | 

0 wa See i a a | 


The net effect of component overlaf can be 
a desiratle reducticn in aircraft vulnerable area frovided 
the damage inflicted tTy the hit in the overlap area does not 
cause cther problems. For eéxample, consider a shctline 
through the fuel tank that overlaps the engine. Fuel could 
jeak from the punctured tank onto hot engine parts, causing 
cL re. In this instance, tke probability the engine is 
killed by the hit wculd probatly be higher than 0.6. An 
example of the computation cf aircraft vulnerable area, 
assuming the possibility of ar engine fire, is given in 
maple 6. The overlapping area is assumed to be 10 ft2, the 


fuel tank P ish is assumed to re 0.3, and the Push for the 
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engine is taken as 0.S because an engine fire is assumed to 
cccur nearly always due to a hit on the overlapping fuel 
tank. 9) eben, 


=1-[(1- 0.3 OS Zee 
7. ct ) x ( ) J (2.27) 


and the aircraft's vulnerable area increases to 52.3 £fté. 


| TABLE 6 
| Vulnerable Area Computation for Nonredundant | 
Model With Overlap ard an Engine Fire 

Critica. A x Pp = A 
Ccempcnent Pi cae Vi | 
| Filct 4 £te 1.0 4.0 fté | 
Fuel 60-10=50 £t? ORs 15.0 £t? ! 
| Engine 50-1C=40 £f£t2 0% 6 24.0 fte 
Cverlap ( 
| Area 10 £te se 9.3 eee | 
A= 52.273 | 

V 


Comparing the aircraft's vulnerable areas 
given in Tables 3, 5&5, and 6 reveals that overlapfing the 
engine with the fuel tank reduces the vulnerable area fron 
52 £t2 to 50.2 Ete, provided ne £ite canwoccerus. If a fie 
is likely to occur, the vulnerable area increases fcrm 52 
ft] tovaZae, fee. Thus, overlapping nonredundant critical 
components can reduce vulnerability provided that no undesi- 
rable secondary kill rodes occur. 

Ancther facet of the overlap situaticn is 


the change in the vulnerable area of the overlap area that 


oe 





cccurs when one of the componerts along a shotline has its 
vulnerafility reduced by use c£ a vulnerability reduction 
technique. For example suppose the Prsh of the overlafping 
fuel tank is reduced from 0.3 to 0.0. The vulnerackle area 
Sree Overlap secticn, with the possibility of a fire, is 
reduced from 7.2 ft? to 6.0 ft?. This reduction apfears to 
Gemetrct with the fact that 10 ft? with a Pry, of 0.3, anda 
vulneratle area of 3.0 ft?, has been made invulneratkle. The 
reason for this apparent contraciction is the fact that the 
fuel tank is only one of two overlapping components. 
Generally, when tke vulneratility of one component is 
reduced, the vulnerability of another component along the 
shotline will become nore important. The vulnerable area of 
each ccmponent along the shotlire is referred to as the true 
vulnerakle area, and the components contributicn to the 
overlar vulnerable area is referred to as the incremental 
vulnerakle area. Using the data of Table 5, the true vuln- 
erable areas are 3 ft? and 6 ft? for the overlapping fuel 
tank ard engine areas, and the incremental vulneratle areas 
of the two overlapping componerts are 1.2 ft? and 4.2 ft? 
respectively. 

yo Aalrcrart Mo 


al omposed Or Redundant 

No Overlap. The nonredun- 
dant aircraft model described aktove will now be expanded by 
adding a second, separated engire, as shown in Figure 2.17. 
The seccend engine is assumed to have the same presented area 
as the first engine, 50 ft*, kut its P,,, is taken as C.7 
kecause cf the presence of an additional accessory drive. 
For the purpose cf ccirparison, the aircraft's presented area 
Will remain 300 ft2. The kill expression for this model 


aircraft is: 


feet = (Pilot) 20h. “{EueL Tank) Ones (23023) 
f (Engine 1) .AND. (Engine 2z) ] 
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Table 7 presents the values fcr the vulnerability rparamze- 
Peeoee Ihe Equation fcr the pretabiiity of aircraft survival 


given a random hit on the aircraft is: 





= 1 E P Za 
ee se, Pay, FET an, Fem dt Ee 
which can te rewritter as: 
a = (1 - Px/iy ) eee en) x (2.30) 
m= (Pe, * Pua.) ! 
| 
TABLE 7 | 
Redundant Aircraft Model Without Overlap | 
Critical A X P = A 
| Ccmpenent Pi SAD ea *k/H | 
| Ea ct 4 ft2 ham 4 fte 0 Loe | 
Fuel 60 ft2 Gee Toe Lt SUo ow | 
Engine 1 50 £t2 Une 30 fte2 - 1000 | 
Engine 2 J 0er te Ore So Ete ae ir oe, | 
| A. = 300 ft2 as Zo tte Piya = O07 33 
_ eee a_i 


Eguation 2.30 says that the aircraft is killed if the filot 
is killed, or if the fuel tank is killed, or if both engines 
are killed. CalrEeying CUuGetne MNLtipixzeation andicated in 


Equation 2.30 leads tc: 


Ege * =k /aae eat ae i PK/H ae z 
Pte) Be / 4 Rigo 


a5 


If the assumption is made that the Single hit cannot kill 
both engines (recall the assumption that only the ccmecnent 
hit can te killed), then all cf the component kills are 
mutually exclusive, and all of the products of the ccmpecnent 
kill pickarilities in Equation 2.31 are zero. Hence, the 


aircraft is killed cnly 1£ the pilot or the fuel tank as 


killed, and the Pei and A. are: 
omety ie 9 53/: (2.32) 
p 
A =A tk . (20:25) 
V V V 
Pp f 


In general, only thcse componerts whose loss or damage can 
cause a kill of the aircraft on a single hit will contribute 
their vulnerable area to the total. If the single hit kills 
cnly cne c£ the redundant comfenents, the aircraft is not 
killed, and hence, necthing is contributed to the vulneratkle 
area. Thus, the tctal vulnerable areas for this case is 
just the sum of vulnerable areas for each of the nonredun- 
dant critical components. Ccmparing Table 7 with Takkle 3 
shows the single hit vulnerable area reduces from 52 ft2 to 
22 f£t2 due to the addition of the second engine. Thus, 
redundancy can significantly reduce the vulnerable area of 
the algerart. On the other kEand, if the damage tc the 
redundant component which is kit creates secondary damage 
mechanisms or processes that fropagate to another redundant 
component and kills that component, causing a less of the 
aircraft, the redundant comporents will contribute to the 
aircraft vulnerable areas. For example, suppose the fgrecb- 
ability that a hit cr one of the engines will cause that 
engine tc throw blades into, cr torch, or burn the otter 
engine is 0.1. Because this can happen regardless of the 
engine hit, the compcnent presented area becomes 50 + 50, cr 


190 £t2, and the vulnerable area contributed by both engines 
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is 10 £t2. Thus, this failure mode increases the aircraft 
vulneratle area to 32 ft2. 
Ch SS ALECEAEE Mod 


el 
Comrenents With Overlap. If redundant 


Ee 


Composed of Redundant 
components are now allowed to cverlap one another, as shown 
by the aircraft in Figure 2.18, the computation of the vuln- 
erable area given by Fguation 2.29 must be modified because 
a single hit in the cverlap region can kill both engines. 
For this case, the cross hatched area 
shown in Figure 2.18 is defined as the overlap area. A 
Single hit penetrating this area will have a probability cf 
killing Foth redundant components, and hence the aircraft. 
mis, 1t will be necessary to add the vulnerable area cf the 
overlap region to that of the ronredundant critical ccmfo- 
nents. In essence, the overlap region becomes another crit- 
ical component, as in the nonredundant model with overlap. 
The vulnerable areais computed in the same manner as 
described previously; however, the details are slightly 
different. The expression fcr Poyh given by Equation 2.20 
must te modified. ACCOL@aug to Equation 2.20, thes ~Erobp— 
ability that the aircraft survives a hit on an overlap area 


with ro redundant components is given by: 


P = Pp x P x P. -egee- = X Po (2.34) 

5 N 

However, if there are two recundant components amcng the 
components along the shotline, such as components numter 2 
and number 3, the prctability that both are killed, which is 
assumed to cause an aircraft kill, is equal to the preduct 
eee neir individual rrobabilities of kill, (Peo X Pe/h3)- 
The probability that L-oth components are not killed, which 
is required for aircraft survival, is the complement of 
(Py x Peyh aoc eG, X Pry ine Thus, (P, xX Ps) 
in Equation 2.34 must be replaced ae = (ae X Py) ] 


and the result is given by Equation 2.35. 


oF 
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P = — x Et = (Pe x & Den zotever aX 1P (23>) 
O =i k/hs k/N3 Sy 
fomeeout example, the probability the aircraft will survive a 


hit on the overlap region is given by: 


= = 2 
Ps/n 1 i ji P s/hes (2. 26) 
and the probability of kill given a hit on the overlap 


regicn is: 


Pisa, = 1 = PT ny se Pern, | ] (2237) 
This proecedure can be extended to the situation where there 
are three or more redundant overlapping components or 
multirle sets of overlapping recundant components. 

The "elsewhere" or non-overlapping areas 
of each of the redundant compcnents are not used in the 
vulneratle area computations fcr the same reason as- that 
used in the no overlaf case. A single shotline through any 
one cf the redundant componerts outside of the overlap 
regicn causes only a kill of that component, nct of the 
aircraft, and hence no contrikwtion is made to the aircraft 
vulnerable area. If the Pom values for the engines in the 
overlap region shown in Figure z.18 are taken as 0.6 for the 
first engine hit and 0.2 for the overlapped engine (the 
cverlapping engine slows the Ccamage mechanism down), the 
probakility the aircraft will survive a hit on the overlap 
region is given by Egvation 2.3€ and is equal to 0.88. The 
probability of an aircraft kilj given a hit in the overlap 
regicn is given by Eguation 2.37 and is egual to 0.12. he 
the overlap area is assumed to be 10 ft2, the vulneratle 
area increases to 23.z ft? due to the overlapping engines as 


Shown by the computation in Takle 8. 


og 


| TABLE 8 


Redundant Aircraft Mcdel With Overlap 


| Critacal A a P = A Pp 
Ccmpcenent EP k/h, v. ae 


a a a as cr a a ee es Bred ces es ecg 


ail ae 
Bree yu fte 120 #.0 ft2 - Ones 
Fuel 60 £ft2 03 18. 07bee - 0600 
| Cverlap 
Area 10 £t2 Ora 12 1.2 f£t2 -00 40 
| A = 300 ft? A. °= 23.2 f£t2 P = .O07 7 
| Pp V K/H° 


rE. Multiple Fit VYouluerchaiity 


The analysis will now progress to the more 
reascnakle expectaticn that in any combat engagement, an 
aircraft, if hit, will receive more than one hit. The 
distribution of these hits over the aircraft is assumed to 
ke random, and all hits are assumed to travel along shot- 
lines frem the same direction. This latter assumpticn is 
not required, but is taken for é€ase of explanation. 

The probakility the ith component still survives 
after n random hits cn the aircraft, denoted by Pura, is 
egual tc the product cf the comfonent survival protabilities 
for each of the n hits on the aircraft. The superbar nota- 
tion cn PB indicates the joint frrobability, and the super- 


script n in parentheses indicates the hit number. Thus, 


(n) 


s/t, (2.38) 


> = (1) (2) 
P_(n) Ty. t S/H: x P S/H, x eee x Pp 
: a al 
le 
where Po /Hy is the frobability the ith component survives 


the jth hit on the aircraft. The probability sor Survival or 
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the ith component due to the jth hit on the aircraft is 
equal to one minus tke probability of kill of the ith ccmfo- 
memc due to the jth hit on the aircraft. fThus, 


(3) fap) 


P a | = 2 (2229) 
S/H, k/H; 
Recall that PH is assumed to be a constant value for all 
Be 
Beeeenus, Equation 2.28 can be civen in the form: 
P = ee) =[14-P n (2. 40 
wl ‘ k/H; ees k/H; J 2 40) 
3 — 


PicmeOLeObauilityeunOt SULVivar of the  aircrait 


after n hits can be derived in a similar manner to give: 


(a) 
K/H 


~ n 
Bee - (i-F 


a a (2.41) 


where Pe rm the PLOLaDtlic yeot Kit) OL the aircraft due to 


jmfemyth hit on the aircraft, ard may or may not be constant 


Some dadill j. The proktability the aircraft is killed after n 


hats, ae . is the ccuplement cf Boy 7. Ou 
op (n) n (3) 
PH = 1 PSH = 7 lle Py ) (22202) 


a 

In any multiple hit assessment, it is necessary 
to keer in mind tke distinction between the effect of 
multifle hits on tke vulneratle area of a nonredundant 
aircraft model as ofpfosed to hits on a redundant aircraft 
model. Multiple hits ona ncrredundant aircraft model do 
not change the total vulnerable area and the Py because of 
the assumption that components are either fully functional 
or killed. Mead Shorten tomeleesalrerart but not a critical 
component, the vulnerable area and the Pay remain the same. 
Cniy when a hit actually strikes the vulnerable area of a 


honredundant critical component is the aircraft killed. 


The redundant aircraft model has to te viewed 
Gliffrerent in. If the redundant aircraft takes the first hit 
in the vulnerable area of a redundant component, the 
aircraft is not killed, but the aircraft vulnerable area and 
the ae will increase for the second hit because cne cf the 
redundant components has been killed. For instance, if one 
of twe engines is killed on tke first hit, the aircraft 
vulnerable area iS mnecw increased by the vulnerable area of 
the remaining engine tecause a kill of the remaining engine 
on a subsequent hit causes an aircraft kill. 

Three methods are fresented below to shew the 
effects cf multiple hits: The kill tree diagram, the state 
transition matrix (or Markov chain) method, and a simplified 
approach. The first method is more of an instructional 
tocl, whereas the transition matrix method can be used in 
complex problems beycnd the practical capability of the kill 
tree diagram. The simplified approach is the ¢éasiest to 
use. 

(il) fhe S21) (trees viageane The seguence cf 
events explained abcve regarding the effects of multifle 
hits can be illustrated diagramuatically using what is known 
as a kill tree diagran. The probability of kill cf each 
component given a random hit on the aircraft is first 
computed using Equaticn 2.6, then the kill tree diagram is 
created. To Simplify the explanation, consider the nonre- 
dundant aircraft model with no cverlap illustrated in Figure 
2-15 and defined in Table 3. 

The Kill Tree Diagram, Nonredundant Mcdel. 
Figure 2.19 presents the kill tree diagram that defines the 
mutually exclusive kill proktatilities of each nonredundant 
critical component (filot, fuel, and engine), and hence the 
aircraft, and the probability that no critical components 


are killed after the first hit cn the aircraft. 
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Figure 2.19 First Hit BKonredundant Kill Tree 


In Figure 2.19, P = F = P nS 


a ee k/H¢ ~ Payne! 
represents the probarility that no critical compcnents are 


and N 


killed and is given Ly N = 1-(E+tF+£). Note that PtFtE+N is 
unity; all possibilities have been accounted for on this 
mest hit. The prokability the .aircrart is killed on this 
first hit is given by P+tFtk&. 

Figure 2.20 represents the kill tree 
diagram after the seccnd hit. PxP represents the situation 
where the first hit killed the pilot, andthe second hit 
also killed the pilot. ie is important to note, however, 
that cnce a probability of kill is defined for each critical 
component on the first hit, that component is ccnsidered 
killed at that probakrility valve for all subsequent hits. 
The pilot cannot be killed twice. The four branches from 
that kill probability for the second hit adds nothing new 
(no additional probability of filot kill) to the sequence. 
This fact can be verified by examining the sum of the kill 
Frobarilities PxP FPxF PxE ExN, which is the same as 
Px (P+F+E+N). Thus, this line is egual to the protakility 
calculated for P on the first hit because P+tFtE+N is unity. 
Mmiemcnty addition to the kill probability of the aircraft 
due to the second hit comes from critical components not 
killed cn the first hit. This concept will become clearer 


and mcre important when redundart components are discussed. 
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FxP FxF FxXE "/ \" NxF NXE NxXN 


EXP EXF PXE PxN EXE VEX EXE Qoxn 


Lee 


Figure 2.20 Second Hit FKonredundant Kill Tree 
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In crder to illustrate the develcpfment of 
a kill tree diagram, assume the numerical values’ fer the 
component kill probakilities given in Table 3. Figure 2223 
illustrates the kill tree for the fiesce hee The 
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Figure 2.21 First Hit Nonredundant Kill Tree Example 
Frobakility the aircraft is killed after the first hit is 
the sum cf the kill frobabilities for each of the critical 
components. Thus, 


5 fs =.,.0133 + .060C 4921000 = [021723 (2. 43) 
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and hence, 


yl) 
eS Set Seo. 1733 =Pueo2oy (2.44) 


S/H 
Figure 2.22 extends this example to the 
second hit. The prebability the aircraft is killed after 
the second hit is the sum of tke additional kill probakili- 
ties for each of the critical ccmponents for the second hit. 
mn S » 


— (2) =(1) ages 

P/E = Pg tryouts Ole eo Ot. TOOO) | (22785) 
and hence, 

pea. ) aD») 

Psvy = a — Puy = 1=- .3166 = .6834 (2246) 
am a ee 
| | 

: | 
ay Nee: ! 
| F E N | 
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Figure 2.22 Second Hit Wonredundant Kill Tree Example 


The kill tree diagram procedure may be 


continued indefinitely to determine Ps yy for any numtker of 
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hits. However, the probability the nonredundant aircraft 
model survives a sequence of hits can also be computed using 
Equation 2.41. For the nonredundant aircraft model, PR/H is 
constant as explained above. Thus, the probability tie 


aircraft survives two hits is given by: 


~ (2) (1) (2) 
Paya = (1 = Pej ) © en ee C1 eng oe (2.47) 
EG) : 

Poyy = (1 - 0.1733)? = 0.6834 (2. 48) 


Note that this value is the same as that obtained frecm the 
kill tree diagram, as it should be. . 

Equation 2.41 can be used for any number 
of hits and is much easier to use than the kill tree 
diagran. The essence of this equation is that all cf the 
nonredundant critical components can be combined intc one 
composite critical ccmponent whcse vulnerable area is 52 ft? 


and whose Psy is 0.1733 in the numerical example. 


Kili tree we agraty, Redundant Model. 
Consider new the redundant aircraft model shown in Figure 
2-17 and defined in Table 7. An evaluation for Be and 


Pay can ke performed ina marner Similar to the previous 
discussicn. Although the engines are redundant critical 
components, each must be shown aS a separate branch in the 
kill tree diagram, because a kill of an engine is a fossitle 
outcome of an aircraft hit; and any engine kill will have an 
effect on the aircraft's vulnerability. Figure 2.23 illus- 
trates the kill tree diagram for the first hit. Note that N 
now represents the probability that no nonredundant or 
redundant component is killed. 

The logical kill expression for this 


redundant aircraft model is given by Eguation 2.49. 
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Pigure 2.23 First Hit Redundant Kill Tree Example 


fertot) .OR. (Fuel Tank) SOR. (2.49) 
[ {Engine 1) .AND. (Engine 2) } 


Because the first hit cannot kill both engines, the preb- 
ability that the aircraft is killed after the first hit is 
just the sum of the kill prcbabilities for each of the 


nonredundant critical components (pilot and fuel). fThus, 


— (1). 


xy 7 90-0133 + 0.0600 = 0.0733 (2. 50) 


Figure 2.24 illustrates the event frob- 
abilities on the seccnd hit after a kill of engine 1 on the 
fanrst hit. The sequence represented by killing engine 1 on 
Maer irst hit and then killing the pilot (0.00133), or fuel 
(0.0600), or engine 2 (0.01167) on the second hit results in 
Ba@@tyonal aircraft kwlls. Thus, thecumulative prokability 
of an aircraft kill is due tc kills of the nonredundant 
critical components as well as kills defined by compenent 
redundancy restrictions. The five branches froma kill cf 
engine 2 and from the N branck will also contribute addi- 
tional kills. Thus, after twe hits, the cumulative frob- 


wemeity of kill is given by Equation 2.51. 
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Figure 2.24 Seccnd Hit After First Hit on Engine 1 


_ (2) 
Poy = 10733 + [.10C0 x (0132 + .0600 + .1167)} (2.51) 
+ [.1167 x (20133 + .0600 + .1000) ] 
+ [.7100 x (.0133 + .0600)] = 0.1646 
and hence: 
pe? = 4 -0.1646 = 0.8354 (2.52) 
“is 5 


Note the significant increase in survivability (0.8354 
versus 0.6834) after the second hit due to the additicn of 
the second engine. 

This procedure can be continued indefi- 
nitely, as in the nonredundant case, but it 1s obvicus that 
the ccmputations quickly beccme overwhelming in complexity. 
The state transition matrix method described below is retter 


Suited tc handle the froblen. 
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(yee state traneltlon vatrix sethod (Markov 
Chait)= Peet, eee westaccs) transition 
matrix method assumes that a sequence of independent events 
(candom hits on the aircraft) can be modelled as a Markov 
process. In a Markcv process, the aircraft is defined to 
have twce or more states in which it may reside, and the 
Beeepabality of an aircraft kill due to the jt1l hit is the 
probarkility that the j+t1l hit on the aircraft will cause the 
eeeebartt to transiticr from a nen~kill state after j hits to 
a kill state. The sequential process of evaluating the 
probability the aircraft exists in each of the several 
possitile states after hits 1, 2, 3, ..-, J is based ufon the 
probakility the aircraft existed in each of the fossitle 
Biemees atter hits 0, 1, 2, ..-, J-1, respectively, and is 
referred tc as a Markov chain. Rather than dwell oon the 
mathematical theory, an example using the previously defined 
redundant aircraft mcdel will serve much Eetter tc illus- 
trate the methodology. 
An aluGnatt Consisting Of a pilot, a fuel 
tank, and two engines can exist in five distinct states: 
1. One cr more of the nonredundant critical components 
(the pilot and the fuel tark) have been killed, 


resulting in an aircraft kill, denoted by Knrc. 
2- Cnily engine 1 has been killed, denoted by Krct. 
3. Cnily engine 2 has been kilded, denoted by Kre2. 


4. Both engine 1 and engine 2 have been killed, 


resulting in an aircraft kill, denoted by Krc. 


5. Nene of the nonredundant critical components and 


neither of the engines are killed, denoted by NK. 


States Knrce and Kre are called absorbing states because the 
aircraft cannot transition from these two kill states tc any 


of the cther three non-kill states. 
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A transition *iatrix Of prebanmeeercs, | ae 
can now be constructed to specify now the aircraft will 
transiticn from one state to another due toa hit cn the 
al Pear ty, Table 9 illustrates the computation of the [T} 
matrix for the example redundant aircraft model defined in 


Table 7. Each element of the matrix represents the 


| TAB reg 


Computation of the State Transition Matrix 


Probability cf transitioning fron 


: this state 
| Knre hisea Krc2 Krc NK tO this 
| state 
i S00 4+18 4+18 0 4+18 Knrec 
| 1 0 30+213 0 0 30 Kr Gal 
30¢ | 0 0 35+2123 0 35 Kroz 
| 0 35 30 300 0 Kee 
| 0 0 0 0 Za NK 


Note that the sum of each column is unity 


~ 4 a 


sf | a eT] 


fFrobability of transitioning from the state defined by tke 
column lccations to the new state defined by the recw loca- 
aOn The matrix is read as follows. The probability of 
the aircraft transiticning fren the Knre state to the Knrec 
state is unity (300/300) because Knrce is an absorbing state. 
The prokability of transitionirg from the Krel statemem) 
cof engine 1) to the Knre state (kill of a nonredundant 
component) is the sum of the conditional probabilities of 
kill cf the two nonredundant couaponents, that is, P+tF. The 


probability of transitioning frem Krell to okrcl{retariang sa 
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fees if the sum of engine 1's probability of kill given a 
hat on the aircraft, El, and that of the remaining “else- 
where" area of the aircraft, N. Leansiaiekoveng Lror Krol to 
Krec2 is zero because a kill of the second engine after the 
first encine 1s killed defines the state kKrc. Thus, the 
Peaeer transitions frem Krelt te Kre according to the cecndi- 
tional frobability of kill of the second engine, E2, and so 
one 

Lote merc ra Dll mye that “the salrcratt 


exists in each of the five possible states after the jth hit 
(5) 


ke expressed by a vector [S] , where 
| Knre 
Kren 
rs]}) = | ere? 


KIC 
| NK 
Note that the sum of the elements in rs}? is always unity; 
the aircraft must exist in one of these five states. The 
probability the aircraft is in each one of the five states 
after the (jt1)th hit is given Ly: 


(j+1) 
My )~=SO = [T] (Ss) > (2. £3) 


on ee rojo 


That is, the aircraft transitions from [S] 
meeording to [T}. 

ANweadlrCGhart Paka 91s defined ky these 
States that specify either a kill of any of the nonredundant 
compcnents or a kill cf enough members of the sets cf redun- 
dant comfonents, such as both engines. In this example, 
Knrce and kKre specify the kill states. Hence, the pfrob- 
ability the aircraft is killed after n hits is given by: 

— (n) (n) (n) 


= C 
P O/H Knre die Kul (22 754)) 


where ede and Kenn are tke probabilities the aircraft 
is in these two states after n tits. 

Using the rumbers generated in the 
previcus numerical example, consider the first hit. Priom 
to the first hit, tke aircraft is entirely in the NK state. 


Thus, according Come quaticn 2... 


c 
C 
5) (0) 
[S] = (TJ (5] = ‘ge C 
C 
1 NK 
Carrying out the matrix multiplication gives: 
020773 Knie 
0.1000 
rsq” = 0. tio 
0 Kine 
0.7100 
Thus, ae = 0.0733 as before. Similarly, for the second 
Per 
0-07 36 
. C.1000 
rs}>) = ap psy? = ry | 0.1167 
0 
0.7100 
Carrying cut the matrix multiplication gives: 
0.1413 Knre 
P1520 
rs}. = Oa17 os 
020233 
0.5401 Kre 


Note that the sum of the elemerts of [SJ] is unity, as it 
Should Fe. The cae vector results reveal that after the 
second hit there is a 14.13 percent probability that either 
the pilct or the fuel tank or Ecth have been killed, a 15.20 
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percent prokability that engine 1 has been killed, a 17.93 
percent probability that engine 2 has been killed, anda 
Beeerr Fercent probability that none of the critical comfo- 
nents have been killed. Thus, after the second hit: 


pi) = 9.1413 + 0.0233 = 0.1646 fees) 


K/H 
This value is the same as that obtained from the kill tree 
diagram after the seccnd hit, as it should be. This prcecess 
can easily be continued for as many hits as desired. Figure 
2.25 shows the De as a function of n for both the redun- 
dant aircraft model and the nonredundant aircraft rodel 
given in Table 3. The differerce between the two curves is 
the reduction in vulnerability due to redundancy. 

In the above fresentation, the transition 
matrix was assumed to be the same for all hits. This 
assumpticn 1s not necessary. If multiple damage mechanisms 
hit the aircraft frcer several different aspects, lepeisel l= 
Sition matrix can [te constructed for each asrect of 
interest. The computation of the state vector for the j+l 
meee GlLVEn by Equaticn 2.53, wotld use the transition matrix 
memethe approach direction of tkat particular hit. Anctker 
possitle modification is the ccrsideration of an increase in 
Pe /Hy due to multiple hits. AGai Nya © jewcoulad ke changed 
from cne hit to the next. 

(3) A Simplified Approach. If the probability 
cf survival of each of the critical components after n hits 
Sie the aircraft is known, an approximation for the eErob- 
ability the aircraft has been killed by the n hits can be 


cbtained by neglecting the mutually exclusive feature of the 


individual component kills on ary one hit. Thus, for the 
example redundant ccmponent aircraft model, Raga tl! GT aces 0 
can Le used. PQldt UGheze 0 ee COn ME Che Heutt Situation, is 


Given by Equation 2.5€. 
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= (1-P iat ee ) ( )) (Dae 
S/H k/#,, k/H K/H,, K/He> 
where 
ae n _— n 
P = = (l=p war, 2 1 (1-p ) (ZS) 
k/Hp k/H, k/H¢ K/H¢ 
and 
Salm): (n). n n c 
(P He ( ) = (1-(1-P y) (1-(1-P ae) (2.58) 
ts) Aas ase wale 


M@eecerding to Equation 2.40. 


btoth the 
approach for sev 
= oo) ar 

P/E Me coth lo 
that the 


and 
close to the cor 


trans 


a 


fats, n 


ry). 

PK/H 
Gerrect 

eer ) 

P/E 
Approximate 


ee 


. 


(4) 
tive prokability 


hecessarily the 


Table 0) presents the Bee Or 
method the 
Note that the approximate 


ie OD eich and Simplified 
eral values of n. 
wer than and hicher than the correct answer 
Keane 


for this example. 


pproxinate probability is reascnarkly 


rect value, 


TABLE 10 | 

A Comparison of Aircraft Kill Probabilities | 
| 

1 3 5 10 20 

O07 32 aoionls - 4456 Ones 9640 | 

=Oieos ao 3 - 4436 - 7470 5 S)eKe) | 

Multiple Hit Vulnerable Area. The cumula- 

of kill given n hits derived above is not 

best measure for assessing or ccmparing 


aircraft designs due to its defendence on the physical size 
o£ the “@lEecrare. If two aircraft have identical vulneratle 
areas, kEut different presented areas, the one with the 
largest rresented aré€a will appear to be less vulneratkle 
kecause its cumulative probability of kill given n hits will 
be less than that of the aircraft with the smaller presented 
area. Cn the other hand, beinc larger, it may suffer more 
hits; that is, it may be more svtsceptible. 

The measure that is the most reaningful 
for vulnerability assessment and comparison of designs is 
vulnerable area. For nonredundant aircraft, the prokability 
cf kill given a hit and the vulnerable area are constant for 
each and every hit. Each suksegquent hit has just as much 
chance of killing the aircraft as the previous hit (assuming 
compcenent degradation is neglected). However, this is not 
true for aircraft with redundart critical components. For 
these aircraft, the frobability of kill given a hit and the 
correspending vulneratle area changes with each hit because 
of the increasing possibility of the loss of one cr mere of 
the redundant components. In crder to compute the rultifle 
hit vulnerable area, an event-based probability cf kill 
given a hit must be ccmputed fcr each hit. In general, the 
probability of aircraft survival after taking n hits was 


given by Eguation 2.41 which is: 


-(n) (1) (2a) ae (n) es 
Pon = (1-Py py) A-Py ay) (1-P iy) (2. 37) 


which alsc can be exfressed in the form: 


=(n) = (n-1) -(n) 2.60 
Dey ian ye (VP) ( ) 


The value desired in Fgquation 2.60 is Bara the event-tased 


probakility that the aireraft 15 killed on the meio 
the aircraft given that it has survived the first (n-1) 


hits. Rearranging terms in Equation 2.60 gives: 
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(n) ae TAD) =(n— i) 
» = Dee | 
1 Pe (Pe 7) Vi (Psy ) ( ) 


EGUation 2.61 can alsc be given in the forn: 


(n) =n) (T=) 
= = p _- a - fp ) (2ee2) 
il PH (1 PH iN K/H 
and hence, 
Boe ot) pm, , a - pi} (2. 63) 
K/H K/H K/H K/H 


The vulnerable area fcr the nth hit, me , 1S computed using 


= (1) 
the PH 


area equation, Eguaticn 2.1. Tkus, 


given by Equation 2.€3 and the basic vulneratle 


me fa) ('™) (2.64) 
V P K/H 


ae Figure 2.26 shows the oe for the Be oe 
Same MOdel Pyy; given in Figure 2.25. Note that the Ay is 
just the sum of the vulnerable areas of the nonredundant 
components. Note also the asymptotic behavior for the 
redundant model. The constant wulnerable area of the ncenre- 
dundant aircraft given in Table 3 is also plotted in Figure 
2.26 for the purpose cf comparison. Note that the vulner- 
able area of the redundant aircraft is less than that of the 
nonredundant aircraft (with the 30 ft? vulnerable area 
engine) for the first fifteen hits. On subsequent hits, the 
vulneraktle area is slightly larger due to the fact that 
there is a strong likelihood tkat one or the other of the 
two engines has been killed, ard the benefits of redundancy 


have keen eliminated. 
c. Presentation of Resrtlts 


Nonexplcsive projectile results normally will be 


presented in summary forms cf total A. of nonredundant 
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components for each combinatior of threat, KI Liacategqory, 
and striking asrect assessed with the striking velocity 
weeyang from 500 to 3500 ft/sec. Manual assessments for 
nonexplcsive projectiles will Le performed for at least the 
Six majcr views of tke aircraft. A computerized assessment 
will be performed fcr at least the six major views and 
usually for a total cf 26 views spread at 45 degree incre- 
ments of elevation and azimuttkt as described earlier. A 
typical total aircraft single hit vulnerable area summary 
forme 1S Shewn in Figure 2.27. Multiple hit vulnerakle area 
curves Similar to tke one showr in Figure 2.26 should also 
be presented for at least six aspects. 

Pueacad CichwmrOmtnestOtalediitcratt | A ipresenta- 
tion, the vulnerable area of each critical component should 
also te listed, and toth the true and the incremental vuln- 
erable areas should be presented for overlapping components. 
Redundant components should be identified, and the number of 
redundant components that must be killed to cause an 
aircraft kill should be noted. The single hit vulneratkle 
area asscciated with cverlappine redundant components should 
also te identified. Figure 2.28 shows a sample component 
vulnerable area summary form. 

For explcsive prejectiles and contact fuzed 
missiles, vulnerability data ncrmally will be presented as 
Summary forms of the total A, of nonredundant components for 
each comkrination of threat, kill category, and aspect angle 
assessed. These results usvally are not presented as 
varying with the fragment striking velocity. Each major 
redundant component will be skown separately if assessed. 
Assessments will be performed for at least the six major 
views and for 26 views if possiftle. Domenie pro |ectiles, in 
addition to the total aircraft vulnerable area, the ccentri- 
bution try subsystem or aircraft region should also be 


presented. Mi See ale leCnvonc Bort lat eto tice nonexpicsive 
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event G08 a Aircraft 
eentonming organization Threat 
KUll category Asoect 
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Figure 2.28 Sample Component Vulnerable Area Fors 


Peeyectile, or ina sketch of the aircraft with regicns 
Shown and the region's presented area and vulneratle area 


Summarized on an acccmpanying fcro. 


2. Blast 


Aircraft vulnerability to external blast is usually 
expressed as an envelcre about the aircraft where the deto- 


Nation of a specified charge weight of spherical uncased 


pentolite high explosive will result in a Specified level. 
damage or kill to the aircraft. Detonation outside of such 
an envelore will result in little or no damage to the 
aircraft or ina lesser kill level. The damage mechanism is 
the Elast resulting from the déetonation of the high explo- 
Sive in the vicinity cf the aircraft. A spectrum of charge 
weights are often specified £or which the aiTreraet vulnen. 
ability measures are computed in the vuinerability assess- 
ment. The specific charge weights selected are 
representative of the expected threat warheads which might 
be encountered. Envelopes are determined for a variety of 
encounter conditions which account for variations in 
aircraft speed and altitude, as well as aSpect. Aiperars 
critical components vulnerable to the external blast consist 
principally of pcertions of the airframe structure and 
contrel surfaces. Threshold kill criteria for the crimtveat 
compenents are derived from structural and aerodynamic anal- 
yses. Cnce the blast pressures and impulse levels reguired 
for a compcenent kill are determined for several locaticns on 
the aircraft surface, a contour may be plotted correspending 
to the detonation distance and the weight of pentolite which 
will frevide the reguired overpressure and impulse leével. 


Two different graphical presentations of the data may be 


used. The first is a plot of charge weight versus distance 
for a constant kill level. Several curves can be drawn on 
the same graph, one for eack altitude of interest. A 


Similar graph is required at each azimuth and elevation 


angle of interest abcut the aircraft. Figure 2.29 is 7am 
example cf this type cf presentation. The second grarfhical 
method, illustrated in Figure 2.30, is to construct iso- 


charge weight contours about the aircraft for a given kill 


level and altitude in all planes of interest. 
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See Endgame Analysis 


The probability of an aircraft kill due to the [urst 
of a specific warhead for a particular set of encounter 
conditions, Peyp s is dependent upon how many fragments hit 
the aircraft and_ the aircraft's vulnerability tc the 
tit awple hits. The number of fragments which strike the 
aircraft was derived in the previous chapter and _ the 
aircraft's vulnerability to multiple hits was discussed in 
the previous section.’ The Pe/p due to the n hits’ on the 
meeecrart 15 analogous to the Ph cer ivc delim ciiosGhapter 


Sac liecr. Thus, Peyp can be estimated using cumulative 
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Figure 2.30 eee ceee External Blast K-Kill Contour for 
Various Weights cf Uncased Pentolite at Sea Level 


Frobakility of kill curves similar to the one shown in 
Figure 2225- Simplified eguations for Pe/D in terms of the 
aircraft vulnerable area and the n hits are derived relcw. 


The probability the aircraft is killed given the jth 


— (n) 
random hit by a single fragment, Baie can be determined 
using the procedure described in this chapter. The prob- 


ability that the aircraft is killed by the n independent, 


oa yap 


random hits from detcnation, Pay! is given by Equation 


2-42. Therefore, 


= (n) - 
Pee Pe es 1 ee 


K/H K/D (2265) 


ioeecan Fe shown that for small p')? 


RSH 
i (3) Ge 
Oe, ,) = exp(-2P.,,) (2. €6) 
j=l j=l 
Furthermcre, 
Nn (35) C3) 
Le PH =a o-) A, / Ay (2.07) 
j=l ae 
Hence, Pe/D can be given in the forn: 
aed ( 9) Deus 
ey | COUP SS (- p/n) Y A, ) (2. €8) 
j=l 
meeerding to Equation 1.33. If there are no redundant crit- 


ap 


ical ccmfonents, Ay is usually assumed to be a constant 


value for all hits, and oe Sinplifies to: 


/D 


P = 1] - ~ 
K/D eae 0 oe 7, NES) 


An example of the computation cf oon for. an encounter is 
given in Table 11. 
iietem=es NO unigue value for Py7, for @ warhead 


detonaticn at a specific location with respect to _ the 


auecrtaft. Pip will be different for detonations at the 
Same distance, but at different locations around the 
minGraft. Nevertheless, the aircraft's vulnerability to an 


externally detonating warhead is often indicated only with 
respect to the distance of the detonation from the aircraft, 
without regard to the cther variables. 

A typical curve relating PRYD to the detonation 
distance, R, is given in Figure 2.31. This curve is 
referred to as the kill functicr given a detonation, and the 
radius at which PK/D is equal to 0.5 is called the lethal 
radius of the warhead. The valve of Px /D specified for each 


value of R could be the average of the Peyp 'S computed for 
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TABLE 11 


An Example Compttation for ve 


Static Warhead Spray angles, % = 50, %5 = 120 
Parameters 

Number of fragments, N = 1000 
Fragment velocity, V; = 7000 fps 
Encounter Missile speed, V, = 1500 fps 
Parameters ok 

Missile ancle, 9 = 30 

Cetonation distance, R = 80 ft 


Aircraft speed, V = 1000 fps 


Aarcraft Aircraft presented length = 50 ft 
Parareters 
Aspect vulnerable area, AD = Zo ite 


(to fragmert size and strikin 
velocity under consideration 


Fragmentation >, Tan-1[7644 7 1515] - 30 
Dynamic spray 
| Angles >, Tan-![4250 / -5763] - 30 


Fragnent 


: 1000 / ;2 x pence oe 1. 059 7 
sfray Density 


-0235 fragments/ft? 


Protabilit E = 1 - exp (-0.0235 x 25 
moet 7 au Pi 
Feyp = 0.48 


a ney egy ES eins et Nee Oe ee es Ce gets Gate eS cc ete SOME gy mts Me ny ES a gap OR AER pee ng ST Mn eer SS GER gee 


a SS. eee Se ae ee 


several different enccunters at R, or the Py /p values could 
be weighted with respect to the expected probability of 
encounter occurrence in order tc obtain a weighted average. 
For example, if a certain mwissile only approaches’ the 
pmerdatt frem the rear aspect, only Pyyp values for that 


type of encounter would be competed. 


ize 


E. VULNERABILITY TO INTERNALLY DETONATING HE WARHEADS 


Anti-aircraft prcejectiles 2Cmm and larger often have an 
HE core with a contact fuze that detonates the warhead 
either immediately or shortly after impacting the aircraft. 
This results in a detcnation cn or inside the aircraft, with 
the acccmpanying blast and fragment spray in many direc- 
tions. The assumpticn of parallel trajectories or shotlines 
through the aircraft used in the nonexplosive penetrator 
vulnerability assessment 1S net valid in this situaticn. 
Instead, the fragment shotlines emanate radially from the 
location of the warhead burst point. The probability of 
kill cf any critical components that lie on any of the 
radial fragment shotlines needs to be evaluated and the 
aircraft's vulnerable area and probability of aircraft kill 
given a hit computed. 

There are several approackes to this problen. Cne 
Simple apfroach is to expand tke presented area of each of 
the critical components beyond the actual physical size of 
the ccmpenent, and then treat @ hit by the HE round in the 
expanded area in the Same manner as that used for the 
nonexplosive penetratcr. For example, the presented area of 
the pilct could be tke entire cockpit, because any hit and 
detonaticn within the cockpit cculd kill the pilot. Figure 
Z.32 illustrates this approach. If the expanded areas of 
two or mcre components intersect or overlap, the procedure 
for accounting for overlapping components described above 
must ke used. 

In another procedure, the warhead detonation is assumed 
to take flace at individual locations within a grid superin- 
posed cn the presented area of the aircraft, as illustrated 
in Fi gune | 2.54. Each cell ccntains one randomly located 
bULrSt “pare. The frobability of killimqg the alrvresaitess 
then evaluated for each burst feint. This Kil) probabiiie, 
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will re dependent uren the relative location of the adiacent 
critical components and on any shielding of these components 
Peeyvaded by intervening structure and non-critical ccmfo- 
nents. Critical ccmponents, or parts of critical comfo- 
nents, cutside of the cell in which the burst occurs must 
also te considered when they can be hit and killed by the 
damage mechanisms. Note that several redundant critical 
components can possitly be killed by the single HE burst. 
The burst point kill probability is determined using the 
kill expression for the aircraft. However, because mcre 
than cne critical ccmponent can be killed given a single 
burst, the individual component kills are not exclusive; a 
Single burst could kill both the fuel system and the filct. 
Thus, the approach used in the overlapping component rodel 


to compute P must also be used here. The probability of 


ie 
an aircraft kill given a randon hit from the attack aspect 
under consideration is obtained by multiplying the frob- 


@emeety Of alrcraft kill given a hit computed for each turst 


Eornt, Pye, by the probability of a random shot hittirg 
the burst foint area, Pa? The latter probability is given 
ey: 
P, = A,/SA a ee (Daan 
b P 


where B is the number of burst points or cells considered, 
and A, 1s the local grid cell area around each burst fecint. 
Note that even though critical components outside of the 
cell are included in EK/H, , just the area of the cell itself 


is used in the computation. The Ba for the aircraft given 


7 a 
a random hit is given by: 


B B 


P = ye = 
a (Py Pers, aA, © tA) Pg (2.74) 
b=1 b= 


where nee 45 the vulnerable area of the bth cell. 
b 
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The aircraft vulnerable area is computed using: 


B B 


Sao » Ay Ee = - Ay (2592) 
p= = 


which is the sum of the vulnerable area of the individual 
cells. 

The vulnerable area for internally detonating HE 
warheads is usually much larger than the vulnerable area for 
nonexplcsive projectiles and fragments, but it can never 


exceed the aircraft's presented area. 


Fe VULNERAPILITY TO IASERS 


Because a laser beam must hit an aircraft to damage it, 
and because no high explosive charge is involved, the meth- 
cdoicgy for assessing the vulnerability of aircraft to 
lasers ccnsists of essentially the same procedure as used in 
the assessment of aircraft vulnerability to the single 
nonexplosive penetratcr. 

Laser vulnerability is particularly threat sensitive. 
The first step of the assessment consists of developing a 
description of the target. Fereign intelligence data and 
Mirror technology are used to describe the target. From 
this data a computerized target description is generated, 
allowing the critical components and their failure modes to 
be identified. The second step of a laser vulnerability 
study is to accumulate data on the energy density required 
to produce failure of the critical components, and energy 
density data on the Larrier materials which shield the crit- 
ical components. Frem this data, burn through times are 
calculated as a function of laser beam intensity, fower, 
type of material, and thickness using a parametric penetra- 
tion equation. A shotline program, using the computerized 


target description, is used to determine the critical 


les 


components and thickness of tke shielding material which 
must ke penetrated along each shotline. HOE Cache. laser 
dwell time interval, energy is allowed to accumulate, and 
the time it takes for critical component failure is 
recorded. An aiming accuracy function is applied for each 
shotline and the protability of kill, given a laser liccked 


onto target, for each dwell time is calculated. 


P K/L (ste): g 
The general description cf laser vulnerability assess- 
ment descriked above applies orly to aircraft and ends with 


Pp ( 
K/Lo 
Fore comrlicated and takes intc¢c account damage produced by 


el 6 Laser vulnerability assessment of a missile is 


the laser to the missile's seeker/guidance system during its 
trajectcry so that the missile misses its target. It should 
be noted that, for an air defense weapon, the laser is not 
effective in bad weather conditions where the relative 


mama ity is high. 


G. CCMPUTER PROGRAMS FOR VULNEFABILITY ASSESSMEAT 


The determination of an aircraft's vulnerability can be 
a complex and time ccnsuming task. When done manually, many 
Simplifications and assumptions are made, the results are 
subject to interpretation, and the output is usually lirited 
in sccfe. Conseguently, an extensive number of computer 
programs or models have been developed by the U.S. military 
and industry for assessing aircraft vulnerability. These 
programs can be divided into fcur major categories; shot- 
line generators, vulnerable area routines, internal t-urst 
Frograms, and Endgame programs. Programs in the first two 
categories are used for the peretrator and single fragment 
damage mechanisms. Those in the third category are used for 
internally detonating HE warheads, and those in the fourth 
categery are for the proximity fuzed HE warhead. (The 


reader is cautioned that just because a computer is used, 
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the results are not to be treated as sacrosanct. The outrfut 
is no mere valid than the assumptions that were used to 
develcr the model and the input data.) 

Computerized techniques for vulnerability estimates for 
nonexflcsive projectiles and single fragments are currently 
in wide use. A prerequisite fer performing such analyses is 
the generation of a geometric model of the aircraft 
descriting all of tke critical components andthe major 
structumse and nonvulnerable components that prcvide 
shielding for the critical compcnents. The computer is then 
programmed to project shotlines (parallel rays) through this 
model, from selected viewing asjyects to provide a sequential 
listirg cf penetraticn data fcr input toa computerized 


vulnerability analysis. 


1. Shotline Generators 


—_ 





These programs generate shotline descriptions of 
aircraft targets for use as inyfut data to the codes which 
calculate vulnerable area. The programs usually model the 
aircraft external surface and the individual internal and 
external components either with a set of geometric shares or 
with surface patches. The target geometric infcrmation 
required to assess the vulnerability by computer pregram is 
generated mathematically by superimposing a planar grid over 
the target model and by passing a large number of parallel 


rays through the target from the attack direction tc the 


cther side (normal te the grid) through individual gia 
cells, as shown in Figure 2.34. The position and number of 
rays is determined by means of the superimposed grid. The 


number cf rays is ccntrolled Ey selecting the size of the 
individual squares of the grid. One shotline is randomly 
located within each cell. Each ray-surface encounter is 
listed sequentially ard identifies the ray location, surface 


identification number, thickness, obliguity angle, airspace 
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encountered, and distance between internal surfaces. This 
procedure is repeated for all stotlines originating frcem the 
selected attack directions. Also the A of designated 
components and of the overall target is Snot for each 
viewing aspect. The A, is apfroximated by multiplying the 
number of rays intersecting the target by the area of the 
individual cells making up the crid plane. 

Two families of shotline generatcr routines have 
keen developed. They are the MAGIC, GIFT family anc the 
SHOTGEN, FASTGEN family. The MAGIC and GIFT codes were 
develcped at the U.S. Army Ballistic Research Labcratory, 


Aberdeen Proving Grourd, MD. These codes use the combinato- 


Tial gecmetry approach, With basic body shapes suck as 
spheres, boxes, cylinders, e¢éllipsoids, and cutting ox 
bounding planes, tc descrikeé components. GIFT 1¢ an 


improved version of MAGIC, with simpler input requirements, 
more efficient computation, and computer-generated graphic’ 
displays. The second family, SHOTGEN and the more recent 
FASTGEN and FASTGEN II, is scmewhat Similar to the cther 
family, kEut typically uses the flat triangular patch method 
to describe the compcnent surfaces. SHOTGEN was developed 
Ey the Naval Weapons Center, ard FASTGEN and FASTGEN II are 
improved versions of SHOTGEN sponsored by the Air Force 
Aeronautical Systems Pivision (ASD). Figure 2.35 shows the 
external view of a model built using the combinatorial gecn- 
etry approach, and Figures 2.3€ and 2.37 show the external 
view and some interral comperents of a flat triangular 


surface fatch model, respectively. 
2. Wulnerabl 


These programs generate component and total aircraft 
vulnerable area tables for a single penetrator or fragment. 
The vulnerakle area rcutines car be divided into twe groups, 


the "detailed" or analysis routines, which use the shotline 
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approach to compute the vulnerable area, and the "sinmpli- 
fied" or evaluation reutines which use simplified arpfroackes 
to determine the vulnerable area. The routines in the anal- 
ysis group are usually used fer problems requiring in-derth 
studies. However, ttey have the potential for use in early 
design studies in which only a limited amount of technical 
descriptive data is available. The evaluation routines are 
more appropriate for froblems in which a cursory analysis is 


desired. 
a. Analysis Foutines 


The programs VAREA, VAREAO2, and COVART belong 
to the detailed grour. Inputs to these programs include the 
shotline descriptions of the target model generated by the 
Shotline programs, probability of kill given a hit data for 
the individual components, emfirical ballistic penetration 
data, and weapon characteristics data. Component and 
aircraft single hit vulnerable area data are output in 
tabular forn. 

VAREA is the oldest and least comprehensive cf 
the three routines in this groufy. It was developed in 1965 
by the Naval Weapons Center to conduct vulnerability anal- 
yses cf systems subjected to fragmenting-type threats and 
uses the THOR penetration equations to compute penetrator 
mass and velocity decay due to penetration through the 


components along the shotline. VAREAO2, completed in 1973, 


evolved from the VAREA progran. Its added capakilities 
include a projectile penetration mode, an alr gap fire 
model, a redundant ccmponents nodel, and an opticn tc use 


the DRI fenetration equations irstead of the THOR relations. 

COVART (Computaticr of Vulnerable Area and 
Repair Time) currently represents the state-of-the-art in 
vulnerarle area routines. it incorporates all (cl wthe 


features of the VAREAO2 program and the heliccpter 
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vulnerakle area routines from tke HART program and includes 
a battle damage repair time model. The procedure used by 
COVART tc compute single hit vulnerable areas is essentially 
the same as that described in this chapter for the single 
nonexflosive penetratcr or fragment. The component vulner- 
able area of each cell is the froduct of the cell presented 
area and the probability of component kill for the shctline 
Smmechat cell. The vulnerable area of each ccmponent is the 
sum of the component vulnerable areas computed for each grid 
cell whose shotline fasses through the component. The total 
aircraft vulnerable area is the sum of all of the cell vuln- 
erable areas, considering only the nonredundant critical 
compcnents and any redundant critical component overlap. 
Both true and incremertal vulnerable areas are available for 
the overlapping compcnents. Fedundant critical components 
that do not lie along the same shotline do not contribute to 


the aircraft vulnerarility. 
be. Evaluaticn Routines 


The computer prograr COMVAT is representative cf 
the reutines which belcng to the other group, the sinrplified 
codes. These routines were developed to fulfill the need 
for relatively quick methods fcr computing vulnerable area. 
They are intended tc be used in Situations when use cof the 
more sophisticated reutines may not be feasible or timely, 
Such as during early conceptual design studies. The sinrpli- 
fied routines are not aS accurate as the detailed routines, 
rut they should require ccrsiderably less effort and 
computer run time to use. 

COMVAT was develored specifically to comfute the 
vulnerarle areas of aircraft components to prcjectile 
threats. It is based upon the Same principles as’ the 
detailed routines, but it does not use shotline descriptions 


of the aircraft; instead, it computes component vulnerakle 
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areas on the basis of inptt data describing average 
shielding conditions cn the components. The THOR rfpeneétra- 
tion equations are used tc model projectile velocity decay. 
Secondary effects such as sfalling, projectile yawing 


motions, and projectile break-uf are ignored. 
3. Internal Burst Programs 


Several programs for computing the vulnerability of 
aircraft to internally detonating HE warheads have been 
develcped under the directicr of the Joint Technical 
Coordinating Group for Muniticns Effectiveness (JICG/ME). 
These pregrams are sometimes referred to as point turst 
programs, and the test known program is the PCINTEUERST 
fFrogram. This program uses the second approach descrikfed in 
the secticn on vulnerability to internally detonating HE 


warheads which is the point burst approach. 
4. Endgame Programs 


The Endgame refers to the terminal events in an 
encounter between an aircraft and an HE warhead with a frex- 
imity fuze. Just how the warhead got to the vicinity of the 
aircraft is irrelevant to the Erdgame analysis. The Endgame 
events may include target detection by the fuze, and usually 


do include the warhead detonation, blast propagation, and 


fragment flyout, IU cae ur, and penetration through the 
alleen at tr. The numerical value for’ the Peyp is then deter- 


mined for the given set of enccunter conditions and warhead 
and aircraft characteristics. This procedure is usually 
repeated for many different sets of encounter conditions and 


warhead detonation feints, anc P is established as a 


K/D 
function of the detonation distance. Four Endgame programs 
currently in use are SESTEM II, SCAN, ATTACK, and REFMCD og 


MECA. A fifth program, SHAZAM, is nearing completion. 
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This program was developed in 1977 by the U.S. 
Air Ferce Aeronautical Systems Division to evaluate the 
terminal effectiveness of missiles with nonnuclear blast and 
fragmentation warheads against aerial targets. The P is 
computed with respect to a direct hit, fragment damage, and 
Elast. The program has the capability to simulate several 
fuzing oftions anda general terminal encounter géometry. 
The fragment spray angles and density, and fragment average 
mass, static velocity, cross-sectional area, and coefficient 
Geearag are input data. The target is represented asa 
collection of shapes that are either single fragment vulner- 
able, masking, or fuzing comgrenents. The external shares 
(wing, fuselage, etc.) are nodeled using ellipses, and 
rectangular parallelpipeds are used for the internal ccmfo- 
nents, such as fuel tanks and electronics. The vulner- 
ability cf the components is represented by vulnerable area 
tables. The program can be used to generate 1SO-Py ip 


contours. 
ber SCAN 


SCAN was developed in 1976 under the supervision 
cf the U.S. Navy Pacific Missile Test Center (PMTC) for the 
Joint Technical Coordinatirg Group for AWE CE dit 
SUevyivability (JTCG/AS). The objective of SCAN is to 
Peediwct the probability that an aircraft will survive an 
attack by a missile armed with a warhead. REG ra Giisks 2s 
due te direct hit, fragment damage, and blast are evaluated. 
A few fuzing options are consicered, as well as a general 
terminal encounter ceometry. The warhead is divided into 
polar and radial zones and different fragment sizes, shapes, 
and materials can be specified within each zone. The target 
is modeled using the combinatorial geometry approach, and 


component vulnerability to single fragments is expressed Ly: 
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P =C + fC x Sass] + [Cex Veloerwe s ee) On) 

k/h l 2 3 
where mass and velocity refer to the fragment mass _ and 
velocity. The energy density ard area removal kill criteria 
are alsc options for use with components such as frajor 
structures. Each ccmponent 1S given a material and thick- 
ness and is linked to a subsystem, system, oor aircraft kill 
ky a logical kill exfression, thus allowing the ccnsidera- 
tion cf redundancy. SCAN also kas graphics capabilities for 
evaluation of the input geometric model and output fragment 


impact data. 
Co SRT OR CK 


ATTACK is a Naval Weapons Center revisicn of an 
Fndgame methodology developed at the Naval Missile Center, 
Foint Mugu. The object of ATTACK is to predict the ability 
of amissile to detect and destroy an airborne target. 
DLECCt HAE; blast, and single fragment (component), and 
multiple fragment (structural) kills are considered, anda 
general terminal encounter geometry is provided. The 
warhead in ATTACK uses the concept of polar and radial frag- 
ment spray zones and fragment weight classes. A large 
number of fuze options are available. The progragz reguires 
four target models, one for each type of damage, and one 
fuze model for each ercounter. The components in the single 
fragmert model are fhysically represented by spheres at 
specified locations, and the vujlnerability of each ccmfonent 
1s ccrtained in vulnerable area tables that depend ugfon 
aspect angle, fragment mass, and fragment impact velocity. 
The multiple fragment model uses a segmented cylindrical 
target representation, and the wulnerability of each segment 


1s specified by a critical level of fragment energy density. 
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d. REFMOD (MECA) 


Diemer of MCDM pnoOg ila Pr , developed in 1981, was 
intended tc be a reference model to be used for ccmfuting 
the effectiveness of externally detonating weapons against 
moving targets. (It was later renamed Modular Endgame 
Computer Analysis or MECA). The model was developed under 
the ausfices of the JTCG/ME Anti-Air Missile Evaluation 
Group. KEFMOD has been assembled by incorporating methcdcl- 
ogies frcm many other existing Endgame programs, including 
some significant additional features that enable it te werk 
with a wide variety cf vulnerakility models and to evaluate 
warhead-target combinations that were previously tco curber- 
some to assess. The warhead types considered include the 
continuous rod, divergent fragment spray, convergent frag- 
ment spray, focused fragment controlled motion, and an 
aimable warhead in which the fragment spray density is ncn- 
uniform akout the missile axis. Several fuze routines are 
available, and the cption exists for the specification cf 
fuzing data from flight tests. The target model and vulner- 
ability employed depend upon tke damage mechanism selected. 
These include direct hit, blast, fragment, and ccntinuous 
Od Ccmponent vulnerability types for fragments include 
koth vulnerable area and a Pim iiieeecrrteri1on that 1S a 
function of mass, velccity, and density. For the vulnerable 
area model, components can ke described as_- spherical, 
linear, cylindrical, cr planar in shape, and the ccmpfonent 
vulnerable area tables generated by COVART can be used. The 
Py yh vulnerability mcdel employs cylindrical components, and 
the ccrpcnent kill criterion is given by: 


Co oe 


Pon = C, x (Mass) x (Velocity) (2.74) 
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With lower and upper threshcld values. By Inpucting 


different values for Cap 3 and ye a Variety of kia 


Pied Sg 
criteria can be employed. For example, when C, = 0.5, Cy = 


1, and C,= 2, the energy density criterion is specified. 
€. SHAZAM 


This code was developed at the Air Force 
Armament Laboratory (AFATI/DLY) for the evaluation of air- 
to-air t@issile effectiveness. The program sequentially 
assesses the possibility the target aircraft is directly 
impacted by the missile, the effect of blast overfressures 
upon the target structures, and the cumulative effect of 
warhead fragment impacts on the target structure and crit- 
ical comfonents. The size, shape, and positicn cf the 
target tody and internal ccmponents are described by 
discrete surfaces, ard each surface can be vulnerakle tc a 
direct hit, to blast, or to fragments. The criteria used to 


define the kill of €ach comporent/surface are supplied by 


the user. The program utilizes as much of the aircraft 
descriptions that are prepared for the SHOTGEN and VAREA 
programs aS is economically feasible. A sufficiently large 


number of encounter conditions are assessed to generate a 
Single shot probability of kill that has converged to a user 


specified confidence level. 
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